@oxy.so/core 1.8.1 → 1.9.1

package/src/session/accountDialogController.ts

@@ -297,8 +297,19 @@ function deriveSignInProgress(facts: SignInFlowFacts): SignInProgress {
 
 /** Immutable snapshot consumed by `useSyncExternalStore`. */
 export interface AccountDialogSnapshot {
-  /** The current view. */
+  /**
+   * The current view. Never `'accounts'` without a session: the account menu
+   * describes a signed-in account, so with no bearer the controller shows the
+   * sign-in entry (`'signin'`) in its place.
+   */
   view: AccountDialogView;
+  /**
+   * Where {@link AccountDialogController.back} leads from {@link view}, or
+   * `null` when `view` is the dialog's first view (a back there closes the
+   * dialog instead). Hosts show their back affordance from this, not from a
+   * table of their own.
+   */
+  backView: AccountDialogView | null;
   /**
    * The server-authoritative device directory — principals and the contexts
    * each may act as (ADR 0002) — or `null` before the first read.
@@ -695,9 +706,11 @@ export class AccountDialogController {
     }
     // Signed out. The directory is bearer-read and `SessionClient` drops the one
     // it holds when the device empties, so there is nothing to clear here — only
-    // the in-flight bookkeeping, which no longer describes anything.
+    // the in-flight bookkeeping, which no longer describes anything. The account
+    // menu described the account that just left, so it gives way to the entry.
     this.error = null;
     this.loading = false;
+    this.view = this.resolveView(this.view);
     this.emit();
   }
 
@@ -705,8 +718,15 @@ export class AccountDialogController {
   // View actions
   // =========================================================================
 
-  /** Set the dialog view directly. */
-  setView(view: AccountDialogView): void {
+  /**
+   * Set the dialog view directly.
+   *
+   * `'accounts'` is only honoured with a session. Signed out it lands on the
+   * sign-in entry instead — the menu it would open holds "Switch account",
+   * storage and "Sign out" for an account that does not exist.
+   */
+  setView(requested: AccountDialogView): void {
+    const view = this.resolveView(requested);
     if (this.view === view) return;
     this.view = view;
     // A `'completed'` flow owns no timers, socket, popup, or token — it is only
@@ -719,6 +739,39 @@ export class AccountDialogController {
     this.emit();
   }
 
+  /**
+   * Go back one step: `signup` and `qr` return to the sign-in entry, and the
+   * entry returns to the account menu when somebody is signed in.
+   *
+   * Returns `false` — changing nothing — when the current view is the dialog's
+   * first one, so the host closes the dialog instead. Leaving an active
+   * request withdraws it; otherwise its authorize code stays approvable until
+   * it expires.
+   */
+  back(): boolean {
+    const target = backViewOf(this.view, this.hasSession());
+    if (target === null) return false;
+    if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
+      this.cancelSignIn();
+    }
+    this.setView(target);
+    return true;
+  }
+
+  /** `'accounts'` needs a session; without one the sign-in entry stands in for it. */
+  private resolveView(view: AccountDialogView): AccountDialogView {
+    return view === 'accounts' && !this.hasSession() ? 'signin' : view;
+  }
+
+  /**
+   * Whether an account is signed in here — the precondition of the account
+   * menu. The bearer, not the directory: the directory is bearer-read, and the
+   * menu's content (hero, storage, sign-out) is all about the bearer's account.
+   */
+  private hasSession(): boolean {
+    return this.isAuthenticated();
+  }
+
   /** Switch to the "add account" view (the sign-in entry chooser). */
   add(): void {
     this.setView('add');
@@ -1720,8 +1773,13 @@ export class AccountDialogController {
 
   private computeSnapshot(): AccountDialogSnapshot {
     const directory = this.sessionClient.getDirectory();
+    const hasSession = this.hasSession();
+    // Resolved here as well as in `setView`: the controller is constructed on
+    // `'accounts'` before anyone knows whether a bearer exists.
+    const view = this.resolveView(this.view);
     return {
-      view: this.view,
+      view,
+      backView: backViewOf(view, hasSession),
       directory,
       activeContext: resolveActiveContext(directory),
       loading: this.loading,
@@ -1747,6 +1805,30 @@ export class AccountDialogController {
   }
 }
 
+/**
+ * The view one step back from `view`, or `null` when `view` is the dialog's
+ * first view.
+ *
+ * The sign-in entry is `'add'` ("add another account") when somebody is signed
+ * in and `'signin'` when nobody is; `signup` and `qr` are reached FROM that
+ * entry, so they return to it. The entry itself returns to the account menu —
+ * which exists only with a session. This used to be a host-side
+ * "back = accounts" that assumed a signed-in origin, so a signed-out Back from
+ * "Create your account" opened a menu holding "Sign out" for nobody.
+ */
+export function backViewOf(view: AccountDialogView, hasSession: boolean): AccountDialogView | null {
+  switch (view) {
+    case 'signup':
+    case 'qr':
+      return hasSession ? 'add' : 'signin';
+    case 'add':
+      return hasSession ? 'accounts' : null;
+    case 'signin':
+    case 'accounts':
+      return null;
+  }
+}
+
 /** Factory mirroring `createSessionClient`, for ergonomic wiring by consumers. */
 export function createAccountDialogController(
   options: AccountDialogControllerOptions,

package/src/session/refresh.ts

@@ -63,6 +63,21 @@ const MIN_SCHEDULE_DELAY_MS = 1_000;
 const MIN_FAILURE_BACKOFF_MS = 5_000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60_000;
 
+/**
+ * How long past `exp` to re-mint when a successful refresh handed back a token
+ * that is STILL inside the lead window.
+ *
+ * The device mint returns the session's stored access token until that token
+ * has actually expired, so asking again before `exp` only returns the same
+ * token. Re-arming from expiry in that state computed a negative delay, hit the
+ * {@link MIN_SCHEDULE_DELAY_MS} floor and re-minted once a second for the last
+ * minute of every token — 30+ mints, the server's whole per-minute budget, and
+ * the 429 that followed straddled the real expiry. Waiting until just past
+ * `exp` asks exactly once more, when the server will rotate. The margin covers
+ * the server's strict `exp < now` comparison and a little clock skew.
+ */
+export const REMINT_AFTER_EXPIRY_MS = 2_000;
+
 export interface RefreshDeps {
   oxy: OxyServices;
   store: AuthStateStore;
@@ -447,13 +462,27 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
     if (expSeconds === null) {
       return;
     }
-    armTimer(expSeconds * 1000 - Date.now() - TOKEN_REFRESH_LEAD_MS);
+    const untilExpiryMs = expSeconds * 1000 - Date.now();
+    // The server already answered this token's refresh with this very token:
+    // asking again before `exp` only gets it back again. Ask just after expiry,
+    // when the server rotates (see REMINT_AFTER_EXPIRY_MS).
+    if (untilExpiryMs > 0 && oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+      armTimer(untilExpiryMs + REMINT_AFTER_EXPIRY_MS);
+      return;
+    }
+    armTimer(untilExpiryMs - TOKEN_REFRESH_LEAD_MS);
   };
 
   const runRefresh = (): void => {
     // Clear any pending timer up front so an out-of-band trigger (focus) plus
     // a fired timer can never double-run.
     clearTimer();
+    // Another lane (a request-time preflight) already asked, and the server
+    // answered with this same token: re-arm for just past expiry instead.
+    if (oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+      scheduleFromExpiry();
+      return;
+    }
     void oxy.httpService.refreshAccessToken('preflight')
       .then((token) => Boolean(token))
       .catch(() => false)
@@ -498,10 +527,16 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
     }
   };
 
-  const unsubscribeTokens = oxy.onTokensChanged(() => {
-    if (!disposed) {
-      schedule();
+  // Re-arm only on a token that actually CHANGED. The mint plants the token it
+  // returns even when that is the token already held, and treating the repeat
+  // as new re-armed from an in-lead-window expiry, i.e. at the 1s floor.
+  let lastSeenToken = oxy.getAccessToken();
+  const unsubscribeTokens = oxy.onTokensChanged((token) => {
+    if (disposed || token === lastSeenToken) {
+      return;
     }
+    lastSeenToken = token;
+    schedule();
   });
 
   let removeFocusListener: (() => void) | null = null;