@oxy.so/core 1.9.0 → 1.9.1

package/dist/cjs/HttpService.js

@@ -116,6 +116,24 @@ const RATE_LIMITED_REFRESH_COOLDOWN_MS = 60000;
  * expired so the request carries a fresh bearer rather than racing the clock.
  */
 const TOKEN_REFRESH_LEAD_SECONDS = 60;
+/**
+ * Whether `token` is a JWT that is still valid but already inside the refresh
+ * lead window. `false` for an expired, opaque or no-`exp` token.
+ */
+function isInsideRefreshLeadWindow(token) {
+    try {
+        const decoded = (0, jwt_decode_1.jwtDecode)(token);
+        if (typeof decoded.exp !== 'number') {
+            return false;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        // `<=`: the proactive scheduler fires at exactly `exp - lead`.
+        return decoded.exp > now && decoded.exp - now <= TOKEN_REFRESH_LEAD_SECONDS;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Soft ceiling on the number of live entries in the identity-scoped GET
  * response cache. Crossing it does NOT evict anything (the {@link TTLCache}
@@ -237,6 +255,27 @@ class HttpService {
          * it, and there is exactly one timestamp to reason about.
          */
         this.lastRefreshWasRateLimited = false;
+        /**
+         * The access token the last SUCCESSFUL refresh handed back while it was still
+         * inside the refresh lead window, or `null`.
+         *
+         * The device mint (`POST /session/device/token`) answers with the session's
+         * STORED access token for as long as that token has not expired — it only
+         * mints a new one once the old one is past `exp`. A client that re-mints
+         * {@link TOKEN_REFRESH_LEAD_SECONDS} before `exp` therefore gets the SAME
+         * token back, and because that counts as a success (no cooldown), every
+         * following request re-ran the preflight and minted again: one mint per
+         * request for the last minute of every token, which exhausted the server's
+         * 30/min mint budget. The 429 that followed imposed a 60s cooldown that
+         * straddled the token's real expiry, so the next request went out with no
+         * bearer, drew a 401, found the refresh cooling down, and signed the user out.
+         *
+         * Remembering the answer ends that: while the current token IS this value and
+         * has not yet expired, the server has already said it has nothing fresher, so
+         * the preflight sends the still-valid token instead of asking again. Once the
+         * token crosses `exp` the preflight asks once more and the server rotates.
+         */
+        this.noFresherTokenThan = null;
         this.authRefreshHandler = null;
         this.accessTokenProvider = null;
         this.deviceSecretMintInFlight = null;
@@ -1028,6 +1067,12 @@ class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If the token expires within the refresh lead window, refresh it.
             if (decoded.exp && decoded.exp - currentTime < TOKEN_REFRESH_LEAD_SECONDS) {
+                // The server already answered this token's refresh with this very token:
+                // it has nothing fresher until `exp`. Use it rather than asking again
+                // (see `noFresherTokenThan`).
+                if (decoded.exp > currentTime && accessToken === this.noFresherTokenThan) {
+                    return `Bearer ${accessToken}`;
+                }
                 const refreshed = await this.refreshAccessToken('preflight');
                 if (refreshed)
                     return `Bearer ${refreshed}`;
@@ -1080,6 +1125,7 @@ class HttpService {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
                 }
+                this.noFresherTokenThan = isInsideRefreshLeadWindow(newToken) ? newToken : null;
                 // A success clears the failure timestamp so the next refresh is never
                 // throttled by a stale cooldown.
                 this.lastRefreshFailureAt = 0;
@@ -1113,6 +1159,16 @@ class HttpService {
     noteRefreshRateLimited() {
         this.lastRefreshWasRateLimited = true;
     }
+    /**
+     * Whether the server has already answered a refresh of the CURRENT access
+     * token with that same, still-valid token — i.e. it has nothing fresher to
+     * give until the token's `exp`. The proactive scheduler reads this so it waits
+     * for expiry instead of re-asking at its 1s floor.
+     */
+    isAwaitingCurrentTokenExpiry() {
+        const token = this.tokenStore.getAccessToken();
+        return token !== null && token === this.noFresherTokenThan && isInsideRefreshLeadWindow(token);
+    }
     /**
      * Whether the CURRENT stored access token is already past its `exp`. Drives
      * the shorter post-failure refresh cooldown ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}):

package/dist/cjs/session/refresh.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOKEN_REFRESH_LEAD_MS = void 0;
+exports.REMINT_AFTER_EXPIRY_MS = exports.TOKEN_REFRESH_LEAD_MS = void 0;
 exports.refreshDeviceSecretArm = refreshDeviceSecretArm;
 exports.refreshPersistedSession = refreshPersistedSession;
 exports.createAuthRefreshHandler = createAuthRefreshHandler;
@@ -39,6 +39,20 @@ const MIN_SCHEDULE_DELAY_MS = 1000;
  */
 const MIN_FAILURE_BACKOFF_MS = 5000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
+/**
+ * How long past `exp` to re-mint when a successful refresh handed back a token
+ * that is STILL inside the lead window.
+ *
+ * The device mint returns the session's stored access token until that token
+ * has actually expired, so asking again before `exp` only returns the same
+ * token. Re-arming from expiry in that state computed a negative delay, hit the
+ * {@link MIN_SCHEDULE_DELAY_MS} floor and re-minted once a second for the last
+ * minute of every token — 30+ mints, the server's whole per-minute budget, and
+ * the 429 that followed straddled the real expiry. Waiting until just past
+ * `exp` asks exactly once more, when the server will rotate. The margin covers
+ * the server's strict `exp < now` comparison and a little clock skew.
+ */
+exports.REMINT_AFTER_EXPIRY_MS = 2000;
 /**
  * Arm 1 — the device-secret mint, run under the owning client's PROCESS-WIDE
  * single-flight (`httpService.runSingleFlightDeviceSecretMint`).
@@ -334,12 +348,26 @@ function startTokenRefreshScheduler(oxy) {
         if (expSeconds === null) {
             return;
         }
-        armTimer(expSeconds * 1000 - Date.now() - exports.TOKEN_REFRESH_LEAD_MS);
+        const untilExpiryMs = expSeconds * 1000 - Date.now();
+        // The server already answered this token's refresh with this very token:
+        // asking again before `exp` only gets it back again. Ask just after expiry,
+        // when the server rotates (see REMINT_AFTER_EXPIRY_MS).
+        if (untilExpiryMs > 0 && oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+            armTimer(untilExpiryMs + exports.REMINT_AFTER_EXPIRY_MS);
+            return;
+        }
+        armTimer(untilExpiryMs - exports.TOKEN_REFRESH_LEAD_MS);
     };
     const runRefresh = () => {
         // Clear any pending timer up front so an out-of-band trigger (focus) plus
         // a fired timer can never double-run.
         clearTimer();
+        // Another lane (a request-time preflight) already asked, and the server
+        // answered with this same token: re-arm for just past expiry instead.
+        if (oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+            scheduleFromExpiry();
+            return;
+        }
         void oxy.httpService.refreshAccessToken('preflight')
             .then((token) => Boolean(token))
             .catch(() => false)
@@ -382,10 +410,16 @@ function startTokenRefreshScheduler(oxy) {
             schedule();
         }
     };
-    const unsubscribeTokens = oxy.onTokensChanged(() => {
-        if (!disposed) {
-            schedule();
+    // Re-arm only on a token that actually CHANGED. The mint plants the token it
+    // returns even when that is the token already held, and treating the repeat
+    // as new re-armed from an in-lead-window expiry, i.e. at the 1s floor.
+    let lastSeenToken = oxy.getAccessToken();
+    const unsubscribeTokens = oxy.onTokensChanged((token) => {
+        if (disposed || token === lastSeenToken) {
+            return;
         }
+        lastSeenToken = token;
+        schedule();
     });
     let removeFocusListener = null;
     if (typeof document !== 'undefined') {