@oxy.so/core 1.8.1 → 1.9.1

package/dist/esm/HttpService.js

@@ -113,6 +113,24 @@ const RATE_LIMITED_REFRESH_COOLDOWN_MS = 60000;
  * expired so the request carries a fresh bearer rather than racing the clock.
  */
 const TOKEN_REFRESH_LEAD_SECONDS = 60;
+/**
+ * Whether `token` is a JWT that is still valid but already inside the refresh
+ * lead window. `false` for an expired, opaque or no-`exp` token.
+ */
+function isInsideRefreshLeadWindow(token) {
+    try {
+        const decoded = jwtDecode(token);
+        if (typeof decoded.exp !== 'number') {
+            return false;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        // `<=`: the proactive scheduler fires at exactly `exp - lead`.
+        return decoded.exp > now && decoded.exp - now <= TOKEN_REFRESH_LEAD_SECONDS;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Soft ceiling on the number of live entries in the identity-scoped GET
  * response cache. Crossing it does NOT evict anything (the {@link TTLCache}
@@ -234,6 +252,27 @@ export class HttpService {
          * it, and there is exactly one timestamp to reason about.
          */
         this.lastRefreshWasRateLimited = false;
+        /**
+         * The access token the last SUCCESSFUL refresh handed back while it was still
+         * inside the refresh lead window, or `null`.
+         *
+         * The device mint (`POST /session/device/token`) answers with the session's
+         * STORED access token for as long as that token has not expired — it only
+         * mints a new one once the old one is past `exp`. A client that re-mints
+         * {@link TOKEN_REFRESH_LEAD_SECONDS} before `exp` therefore gets the SAME
+         * token back, and because that counts as a success (no cooldown), every
+         * following request re-ran the preflight and minted again: one mint per
+         * request for the last minute of every token, which exhausted the server's
+         * 30/min mint budget. The 429 that followed imposed a 60s cooldown that
+         * straddled the token's real expiry, so the next request went out with no
+         * bearer, drew a 401, found the refresh cooling down, and signed the user out.
+         *
+         * Remembering the answer ends that: while the current token IS this value and
+         * has not yet expired, the server has already said it has nothing fresher, so
+         * the preflight sends the still-valid token instead of asking again. Once the
+         * token crosses `exp` the preflight asks once more and the server rotates.
+         */
+        this.noFresherTokenThan = null;
         this.authRefreshHandler = null;
         this.accessTokenProvider = null;
         this.deviceSecretMintInFlight = null;
@@ -1025,6 +1064,12 @@ export class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If the token expires within the refresh lead window, refresh it.
             if (decoded.exp && decoded.exp - currentTime < TOKEN_REFRESH_LEAD_SECONDS) {
+                // The server already answered this token's refresh with this very token:
+                // it has nothing fresher until `exp`. Use it rather than asking again
+                // (see `noFresherTokenThan`).
+                if (decoded.exp > currentTime && accessToken === this.noFresherTokenThan) {
+                    return `Bearer ${accessToken}`;
+                }
                 const refreshed = await this.refreshAccessToken('preflight');
                 if (refreshed)
                     return `Bearer ${refreshed}`;
@@ -1077,6 +1122,7 @@ export class HttpService {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
                 }
+                this.noFresherTokenThan = isInsideRefreshLeadWindow(newToken) ? newToken : null;
                 // A success clears the failure timestamp so the next refresh is never
                 // throttled by a stale cooldown.
                 this.lastRefreshFailureAt = 0;
@@ -1110,6 +1156,16 @@ export class HttpService {
     noteRefreshRateLimited() {
         this.lastRefreshWasRateLimited = true;
     }
+    /**
+     * Whether the server has already answered a refresh of the CURRENT access
+     * token with that same, still-valid token — i.e. it has nothing fresher to
+     * give until the token's `exp`. The proactive scheduler reads this so it waits
+     * for expiry instead of re-asking at its 1s floor.
+     */
+    isAwaitingCurrentTokenExpiry() {
+        const token = this.tokenStore.getAccessToken();
+        return token !== null && token === this.noFresherTokenThan && isInsideRefreshLeadWindow(token);
+    }
     /**
      * Whether the CURRENT stored access token is already past its `exp`. Drives
      * the shorter post-failure refresh cooldown ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}):

package/dist/esm/i18n/locales/en-US.json

@@ -1850,6 +1850,7 @@
             "switch": {
                 "title": "Switch account",
                 "count": "{{count}} accounts",
+                "countOne": "{{count}} account",
                 "empty": "Accounts you own or share"
             }
         },
@@ -1970,7 +1971,8 @@
             "loading": "Loading sessions…",
             "empty": "No active sessions",
             "signOutAllOnThisDevice": "Sign out of all other devices",
-            "signOutAllSubtitle": "End {{count}} other device session(s)"
+            "signOutAllSubtitle": "End {{count}} other device session(s)",
+            "otherSession": "Another session"
         },
         "confirms": {
             "removeDeviceTitle": "Remove device",

package/dist/esm/i18n/locales/es-ES.json

@@ -1850,6 +1850,7 @@
             "switch": {
                 "title": "Cambiar de cuenta",
                 "count": "{{count}} cuentas",
+                "countOne": "{{count}} cuenta",
                 "empty": "Cuentas que posees o compartes"
             }
         },
@@ -1970,7 +1971,8 @@
             "loading": "Cargando sesiones…",
             "empty": "No hay sesiones activas",
             "signOutAllOnThisDevice": "Cerrar sesión en los demás dispositivos",
-            "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos"
+            "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos",
+            "otherSession": "Otra sesión"
         },
         "confirms": {
             "removeDeviceTitle": "Eliminar dispositivo",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -1850,6 +1850,7 @@
       "switch": {
         "title": "Switch account",
         "count": "{{count}} accounts",
+        "countOne": "{{count}} account",
         "empty": "Accounts you own or share"
       }
     },
@@ -1970,7 +1971,8 @@
       "loading": "Loading sessions…",
       "empty": "No active sessions",
       "signOutAllOnThisDevice": "Sign out of all other devices",
-      "signOutAllSubtitle": "End {{count}} other device session(s)"
+      "signOutAllSubtitle": "End {{count}} other device session(s)",
+      "otherSession": "Another session"
     },
     "confirms": {
       "removeDeviceTitle": "Remove device",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -1850,6 +1850,7 @@
       "switch": {
         "title": "Cambiar de cuenta",
         "count": "{{count}} cuentas",
+        "countOne": "{{count}} cuenta",
         "empty": "Cuentas que posees o compartes"
       }
     },
@@ -1970,7 +1971,8 @@
       "loading": "Cargando sesiones…",
       "empty": "No hay sesiones activas",
       "signOutAllOnThisDevice": "Cerrar sesión en los demás dispositivos",
-      "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos"
+      "signOutAllSubtitle": "Finalizar {{count}} sesión(es) de otros dispositivos",
+      "otherSession": "Otra sesión"
     },
     "confirms": {
       "removeDeviceTitle": "Eliminar dispositivo",

package/dist/esm/session/accountDialogController.js

@@ -329,16 +329,25 @@ export class AccountDialogController {
         }
         // Signed out. The directory is bearer-read and `SessionClient` drops the one
         // it holds when the device empties, so there is nothing to clear here — only
-        // the in-flight bookkeeping, which no longer describes anything.
+        // the in-flight bookkeeping, which no longer describes anything. The account
+        // menu described the account that just left, so it gives way to the entry.
         this.error = null;
         this.loading = false;
+        this.view = this.resolveView(this.view);
         this.emit();
     }
     // =========================================================================
     // View actions
     // =========================================================================
-    /** Set the dialog view directly. */
-    setView(view) {
+    /**
+     * Set the dialog view directly.
+     *
+     * `'accounts'` is only honoured with a session. Signed out it lands on the
+     * sign-in entry instead — the menu it would open holds "Switch account",
+     * storage and "Sign out" for an account that does not exist.
+     */
+    setView(requested) {
+        const view = this.resolveView(requested);
         if (this.view === view)
             return;
         this.view = view;
@@ -351,6 +360,37 @@ export class AccountDialogController {
         }
         this.emit();
     }
+    /**
+     * Go back one step: `signup` and `qr` return to the sign-in entry, and the
+     * entry returns to the account menu when somebody is signed in.
+     *
+     * Returns `false` — changing nothing — when the current view is the dialog's
+     * first one, so the host closes the dialog instead. Leaving an active
+     * request withdraws it; otherwise its authorize code stays approvable until
+     * it expires.
+     */
+    back() {
+        const target = backViewOf(this.view, this.hasSession());
+        if (target === null)
+            return false;
+        if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
+            this.cancelSignIn();
+        }
+        this.setView(target);
+        return true;
+    }
+    /** `'accounts'` needs a session; without one the sign-in entry stands in for it. */
+    resolveView(view) {
+        return view === 'accounts' && !this.hasSession() ? 'signin' : view;
+    }
+    /**
+     * Whether an account is signed in here — the precondition of the account
+     * menu. The bearer, not the directory: the directory is bearer-read, and the
+     * menu's content (hero, storage, sign-out) is all about the bearer's account.
+     */
+    hasSession() {
+        return this.isAuthenticated();
+    }
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add() {
         this.setView('add');
@@ -1285,8 +1325,13 @@ export class AccountDialogController {
     }
     computeSnapshot() {
         const directory = this.sessionClient.getDirectory();
+        const hasSession = this.hasSession();
+        // Resolved here as well as in `setView`: the controller is constructed on
+        // `'accounts'` before anyone knows whether a bearer exists.
+        const view = this.resolveView(this.view);
         return {
-            view: this.view,
+            view,
+            backView: backViewOf(view, hasSession),
             directory,
             activeContext: resolveActiveContext(directory),
             loading: this.loading,
@@ -1311,6 +1356,29 @@ export class AccountDialogController {
         }
     }
 }
+/**
+ * The view one step back from `view`, or `null` when `view` is the dialog's
+ * first view.
+ *
+ * The sign-in entry is `'add'` ("add another account") when somebody is signed
+ * in and `'signin'` when nobody is; `signup` and `qr` are reached FROM that
+ * entry, so they return to it. The entry itself returns to the account menu —
+ * which exists only with a session. This used to be a host-side
+ * "back = accounts" that assumed a signed-in origin, so a signed-out Back from
+ * "Create your account" opened a menu holding "Sign out" for nobody.
+ */
+export function backViewOf(view, hasSession) {
+    switch (view) {
+        case 'signup':
+        case 'qr':
+            return hasSession ? 'add' : 'signin';
+        case 'add':
+            return hasSession ? 'accounts' : null;
+        case 'signin':
+        case 'accounts':
+            return null;
+    }
+}
 /** Factory mirroring `createSessionClient`, for ergonomic wiring by consumers. */
 export function createAccountDialogController(options) {
     return new AccountDialogController(options);

package/dist/esm/session/refresh.js

@@ -31,6 +31,20 @@ const MIN_SCHEDULE_DELAY_MS = 1000;
  */
 const MIN_FAILURE_BACKOFF_MS = 5000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
+/**
+ * How long past `exp` to re-mint when a successful refresh handed back a token
+ * that is STILL inside the lead window.
+ *
+ * The device mint returns the session's stored access token until that token
+ * has actually expired, so asking again before `exp` only returns the same
+ * token. Re-arming from expiry in that state computed a negative delay, hit the
+ * {@link MIN_SCHEDULE_DELAY_MS} floor and re-minted once a second for the last
+ * minute of every token — 30+ mints, the server's whole per-minute budget, and
+ * the 429 that followed straddled the real expiry. Waiting until just past
+ * `exp` asks exactly once more, when the server will rotate. The margin covers
+ * the server's strict `exp < now` comparison and a little clock skew.
+ */
+export const REMINT_AFTER_EXPIRY_MS = 2000;
 /**
  * Arm 1 — the device-secret mint, run under the owning client's PROCESS-WIDE
  * single-flight (`httpService.runSingleFlightDeviceSecretMint`).
@@ -326,12 +340,26 @@ export function startTokenRefreshScheduler(oxy) {
         if (expSeconds === null) {
             return;
         }
-        armTimer(expSeconds * 1000 - Date.now() - TOKEN_REFRESH_LEAD_MS);
+        const untilExpiryMs = expSeconds * 1000 - Date.now();
+        // The server already answered this token's refresh with this very token:
+        // asking again before `exp` only gets it back again. Ask just after expiry,
+        // when the server rotates (see REMINT_AFTER_EXPIRY_MS).
+        if (untilExpiryMs > 0 && oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+            armTimer(untilExpiryMs + REMINT_AFTER_EXPIRY_MS);
+            return;
+        }
+        armTimer(untilExpiryMs - TOKEN_REFRESH_LEAD_MS);
     };
     const runRefresh = () => {
         // Clear any pending timer up front so an out-of-band trigger (focus) plus
         // a fired timer can never double-run.
         clearTimer();
+        // Another lane (a request-time preflight) already asked, and the server
+        // answered with this same token: re-arm for just past expiry instead.
+        if (oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+            scheduleFromExpiry();
+            return;
+        }
         void oxy.httpService.refreshAccessToken('preflight')
             .then((token) => Boolean(token))
             .catch(() => false)
@@ -374,10 +402,16 @@ export function startTokenRefreshScheduler(oxy) {
             schedule();
         }
     };
-    const unsubscribeTokens = oxy.onTokensChanged(() => {
-        if (!disposed) {
-            schedule();
+    // Re-arm only on a token that actually CHANGED. The mint plants the token it
+    // returns even when that is the token already held, and treating the repeat
+    // as new re-armed from an in-lead-window expiry, i.e. at the 1s floor.
+    let lastSeenToken = oxy.getAccessToken();
+    const unsubscribeTokens = oxy.onTokensChanged((token) => {
+        if (disposed || token === lastSeenToken) {
+            return;
         }
+        lastSeenToken = token;
+        schedule();
     });
     let removeFocusListener = null;
     if (typeof document !== 'undefined') {