@payez/next-mvp 4.5.0 → 4.5.2

package/dist/vibe/sessions.js

@@ -46,10 +46,14 @@ exports.hashSessionToken = hashSessionToken;
 exports.resolveNumericIdpUserId = resolveNumericIdpUserId;
 exports.warnNonNumericUserId = warnNonNumericUserId;
 exports.readSessionRevocationHmac = readSessionRevocationHmac;
-exports.getRevocationStatus = getRevocationStatus;
+exports.isConcurrentLimitBody = isConcurrentLimitBody;
+exports.revocationRetryDelayMs = revocationRetryDelayMs;
 exports.getSessionStats = getSessionStats;
+exports.resetRevocationCache = resetRevocationCache;
+exports.getRevocationStatus = getRevocationStatus;
 const crypto_1 = __importDefault(require("crypto"));
 const token_utils_1 = require("../auth/utils/token-utils");
+const token_log_id_1 = require("../lib/token-log-id");
 // -----------------------------------------------------------------------------
 // CONFIGURATION
 // -----------------------------------------------------------------------------
@@ -457,21 +461,22 @@ async function readSessionRevocationHmac(idpUserId) {
     const signingKey = getEnv('VIBE_HMAC_KEY');
     if (!idpUrl || !clientId || !signingKey) {
         // Caller distinguishes this from a read failure; report ok:false, not [].
-        return { ok: false, sessions: [] };
+        return { ok: false, sessions: [], failure: 'misconfigured' };
     }
     const endpoint = `/v1/collections/${COLLECTION}/tables/${TABLE}/query`;
     const proxyUrl = `${idpUrl}/api/vibe/proxy`;
-    const timestamp = Math.floor(Date.now() / 1000);
-    const signature = generateHmacSignature(signingKey, timestamp, 'POST', endpoint);
-    // NOTE the absence of Authorization. This is the twin's credential.
-    const headers = {
-        'Content-Type': 'application/json',
-        'X-Vibe-Client-Id': clientId,
-        'X-Vibe-Timestamp': String(timestamp),
-        'X-Vibe-Signature': signature,
-    };
-    try {
-        const response = await fetch(proxyUrl, {
+    // Signed per ATTEMPT: the retry below must not reuse a timestamp that has aged.
+    const send = () => {
+        const timestamp = Math.floor(Date.now() / 1000);
+        const signature = generateHmacSignature(signingKey, timestamp, 'POST', endpoint);
+        // NOTE the absence of Authorization. This is the twin's credential.
+        const headers = {
+            'Content-Type': 'application/json',
+            'X-Vibe-Client-Id': clientId,
+            'X-Vibe-Timestamp': String(timestamp),
+            'X-Vibe-Signature': signature,
+        };
+        return fetch(proxyUrl, {
             method: 'POST',
             headers,
             body: JSON.stringify({
@@ -485,10 +490,21 @@ async function readSessionRevocationHmac(idpUserId) {
                 },
             }),
         });
+    };
+    try {
+        let response = await send();
+        // PAY-2136: ONE retry, and only for the transient class. The portal's own prefetch burst exceeds the free
+        // tier's concurrency (CONCURRENT_LIMIT, HTTP 429). Keyed on the BODY code, never on Retry-After: the IdP proxy
+        // relays body and status but drops that header (PAY-2143). AUTH_BLOCKED / other 429s and every 5xx are NOT
+        // retried (a block is not transient; a retry only adds a counted failure).
+        if (response.status === 429 && isConcurrentLimitBody(await safeBodyText(response))) {
+            await new Promise((resolve) => setTimeout(resolve, revocationRetryDelayMs(response)));
+            response = await send();
+        }
         if (!response.ok) {
             // PAY-1427: never the raw proxy body - an error page can echo the request.
             console.error(`[vibe-sessions] Revocation read proxy error ${response.status}`);
-            return { ok: false, sessions: [] };
+            return { ok: false, sessions: [], failure: String(response.status) }; // PAY-2136: status only, for the reason log
         }
         const data = await response.json();
         const unwrapped = (data?.data ?? data);
@@ -496,8 +512,38 @@ async function readSessionRevocationHmac(idpUserId) {
     }
     catch (error) {
         console.error('[vibe-sessions] Revocation read failed:', error);
-        return { ok: false, sessions: [] };
+        return { ok: false, sessions: [], failure: 'exception' };
+    }
+}
+/** Body text of a response WITHOUT consuming the caller's copy; '' on any failure. */
+async function safeBodyText(response) {
+    try {
+        return await response.clone().text();
+    }
+    catch {
+        return '';
+    }
+}
+/** True only for the exact code CONCURRENT_LIMIT (nested error.code, top-level code/errorCode); a non-JSON body falls back to the literal. */
+function isConcurrentLimitBody(bodyText) {
+    try {
+        const b = JSON.parse(bodyText);
+        const nested = b?.error?.code;
+        const code = [nested, b?.code, b?.errorCode].find((c) => typeof c === 'string');
+        if (typeof code === 'string')
+            return code === 'CONCURRENT_LIMIT';
+        return false;
     }
+    catch {
+        return /CONCURRENT_LIMIT/.test(bodyText);
+    }
+}
+/** Retry-After seconds when the proxy kept it (capped at 2 s: this runs in the request path), else 200-400 ms jitter. */
+function revocationRetryDelayMs(response) {
+    const ra = Number(response.headers?.get?.('retry-after'));
+    if (Number.isFinite(ra) && ra > 0)
+        return Math.min(ra * 1000, 2000);
+    return 200 + Math.floor(Math.random() * 200);
 }
 /**
  * THE one revocation decision (PAY-2037 step 1, BAPert 69150): hash-first, per session.
@@ -509,12 +555,15 @@ async function readSessionRevocationHmac(idpUserId) {
  * rule apply: no active row -> the most recently revoked (none revoked: not revoked); else any revoked inside 2h.
  */
 function findRevokingSession(sessions, sessionTokenHash) {
+    return findRevokingSessionWithRule(sessions, sessionTokenHash).row;
+}
+function findRevokingSessionWithRule(sessions, sessionTokenHash) {
     if (sessions.length === 0)
-        return null;
+        return { row: null, rule: 'none' };
     if (sessionTokenHash) {
         const matching = sessions.find(s => s.session_token_hash === sessionTokenHash);
         if (matching)
-            return matching.status === 'revoked' ? matching : null;
+            return matching.status === 'revoked' ? { row: matching, rule: 'own_row_revoked' } : { row: null, rule: 'none' };
     }
     // Hash not found (a legacy row minted before hashing) or no hash given: idealresume's user-wide
     // rules, lib/vibe-sessions.ts:594-651 (BAPert 69189).
@@ -525,11 +574,30 @@ function findRevokingSession(sessions, sessionTokenHash) {
     if (!sessions.some(s => s.status === 'active')) {
         const revoked = sessions.filter(s => s.status === 'revoked' && s.revoked_at).sort(newestFirst);
         if (revoked.length > 0)
-            return revoked[0];
+            return { row: revoked[0], rule: 'legacy_no_active' };
     }
     // Check 2: any row revoked in the last TWO hours (idealresume's window; 5-minute polling needs the time).
     const twoHoursAgo = Date.now() - 2 * 60 * 60 * 1000;
-    return (sessions.filter(s => s.status === 'revoked' && revokedAt(s) > twoHoursAgo).sort(newestFirst)[0] ?? null);
+    const recent = sessions.filter(s => s.status === 'revoked' && revokedAt(s) > twoHoursAgo).sort(newestFirst)[0] ?? null;
+    return recent ? { row: recent, rule: 'legacy_recent_2h' } : { row: null, rule: 'none' };
+}
+/**
+ * PAY-2136: one shape-only line per NON-viable revocation verdict, naming WHICH rule fired. Never a token, userId,
+ * hash, or row content: the rule label, a read-failure status code, a row COUNT and the session's tokenLogId.
+ * Must never throw into the viability path.
+ */
+function logRevocationReason(verdict, reason, sessionToken, extra = {}) {
+    try {
+        console.warn('[REVOCATION] verdict', {
+            verdict,
+            reason,
+            sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
+            ...extra,
+        });
+    }
+    catch {
+        /* diagnostic only */
+    }
 }
 /**
  * Determine whether a session is revoked, with an explicit UNKNOWN state
@@ -552,7 +620,7 @@ function findRevokingSession(sessions, sessionTokenHash) {
  * @param sessionToken - The live session token; hashed to match the stored row.
  *                       When absent, the user-wide check applies (legacy path).
  */
-async function getRevocationStatus(idpUserId, sessionToken) {
+async function readRevocationStatus(idpUserId, sessionToken) {
     const idpUrl = getEnv('IDP_URL');
     const clientId = getEnv('VIBE_CLIENT_ID');
     const signingKey = getEnv('VIBE_HMAC_KEY');
@@ -573,16 +641,21 @@ async function getRevocationStatus(idpUserId, sessionToken) {
     // do NOT report "no sessions". 'unknown' is the fail-closed state.
     if (!idpUrl || !signingKey) {
         console.warn('[vibe-sessions] Revocation check MISCONFIGURED (VIBE_CLIENT_ID set but IDP_URL/VIBE_HMAC_KEY missing) - reporting unknown (fail closed)');
+        logRevocationReason('unknown', 'misconfigured', sessionToken);
         return 'unknown';
     }
-    const { ok, sessions } = await readSessionRevocationHmac(idpUserId);
+    const { ok, sessions, failure } = await readSessionRevocationHmac(idpUserId);
     if (!ok) {
         console.warn('[vibe-sessions] Revocation read failed - reporting unknown');
+        logRevocationReason('unknown', `read_failed:${failure ?? 'unknown'}`, sessionToken);
         return 'unknown';
     }
-    return findRevokingSession(sessions, sessionToken ? hashSessionToken(sessionToken) : undefined)
-        ? 'revoked'
-        : 'active';
+    const { row, rule } = findRevokingSessionWithRule(sessions, sessionToken ? hashSessionToken(sessionToken) : undefined);
+    if (row) {
+        logRevocationReason('revoked', rule, sessionToken, { rows: sessions.length });
+        return 'revoked';
+    }
+    return 'active';
 }
 // -----------------------------------------------------------------------------
 // STATISTICS
@@ -631,3 +704,65 @@ async function getSessionStats(accessToken) {
         recentLogins: stats.recentLogins,
     };
 }
+// -----------------------------------------------------------------------------
+// PAY-2136: SINGLE-FLIGHT + SHORT RESULT CACHE for the revocation read
+// -----------------------------------------------------------------------------
+// Every middleware viability check does one revocation read through the IdP proxy for the SAME Vibe client. A page
+// whose chrome prefetches ~4 links makes ~8 checks inside a second; the free tier allows 2 concurrent queries, so
+// the 3rd+ read was a 429 CONCURRENT_LIMIT and (before this change) signed the user out. Now concurrent callers for
+// ONE session share ONE in-flight read, and a CONFIRMED verdict is reused for a few seconds.
+//   - keyed by userId + the token HASH: never shared across sessions or users;
+//   - only 'active' / 'revoked' are cached: a failure ('unknown') is shared while in flight but never remembered, so
+//     the next request reads again; a revoked session is honoured at most REVOCATION_CACHE_MS late;
+//   - REVOCATION_CACHE_MS=0 disables the cache (single-flight still applies).
+const DEFAULT_REVOCATION_CACHE_MS = 5000;
+const MAX_REVOCATION_CACHE_ENTRIES = 2000;
+const revocationInflight = new Map();
+const revocationVerdicts = new Map();
+function revocationCacheMs() {
+    const raw = process.env.REVOCATION_CACHE_MS;
+    if (raw === undefined || raw === '')
+        return DEFAULT_REVOCATION_CACHE_MS;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? Math.min(n, 30_000) : DEFAULT_REVOCATION_CACHE_MS;
+}
+/** Test/ops hook: forget every cached verdict and in-flight read. */
+function resetRevocationCache() {
+    revocationInflight.clear();
+    revocationVerdicts.clear();
+}
+async function getRevocationStatus(idpUserId, sessionToken) {
+    // No token = the user-wide legacy path: nothing session-specific to key on, so no sharing.
+    if (!sessionToken)
+        return readRevocationStatus(idpUserId, sessionToken);
+    const key = `${idpUserId}:${hashSessionToken(sessionToken)}`;
+    const ttl = revocationCacheMs();
+    const now = Date.now();
+    const hit = revocationVerdicts.get(key);
+    if (hit && ttl > 0 && now - hit.at < ttl)
+        return hit.status;
+    if (hit)
+        revocationVerdicts.delete(key);
+    const existing = revocationInflight.get(key);
+    if (existing)
+        return existing;
+    const read = readRevocationStatus(idpUserId, sessionToken)
+        .then((status) => {
+        if (ttl > 0 && (status === 'active' || status === 'revoked')) {
+            if (revocationVerdicts.size >= MAX_REVOCATION_CACHE_ENTRIES) {
+                for (const [k, v] of revocationVerdicts)
+                    if (now - v.at >= ttl)
+                        revocationVerdicts.delete(k);
+                if (revocationVerdicts.size >= MAX_REVOCATION_CACHE_ENTRIES)
+                    revocationVerdicts.clear();
+            }
+            revocationVerdicts.set(key, { status, at: Date.now() });
+        }
+        return status;
+    })
+        .finally(() => {
+        revocationInflight.delete(key);
+    });
+    revocationInflight.set(key, read);
+    return read;
+}