@quazardous/qdadm 2.17.2 → 2.17.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quazardous/qdadm",
-  "version": "2.17.2",
+  "version": "2.17.3",
   "description": "Vue 3 framework for admin dashboards with PrimeVue",
   "author": "quazardous",
   "license": "MIT",

package/src/entity/EntityManager.ts

@@ -357,6 +357,61 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
     return { storage: this.storage }
   }
 
+  /**
+   * Announce an expired session, whatever the transport (#1905 lot A).
+   *
+   * `auth:expired` used to be emitted only by the kernel's axios response
+   * interceptor. But `SdkStorage` exists so a consumer can bring their own
+   * transport, and one that did — a fetch-based SDK — never triggered expiry
+   * detection at all: the screen kept requesting with a dead token and stacked
+   * one error toast per attempt, indefinitely.
+   *
+   * Watching here rather than in a storage adapter is deliberate. Storages
+   * have no access to the signal bus, and every call passes through this
+   * manager whichever adapter is underneath — so this covers ApiStorage,
+   * MockApiStorage, SdkStorage and whatever someone writes next.
+   *
+   * 401 only, never 403: a 403 says the session is valid and this door is
+   * closed. Logging the user out would send them to sign in again for a
+   * permission they will not have afterwards — a loop, not an error.
+   */
+  protected _watchStorageAuth(storage: IStorage<T> | null): IStorage<T> | null {
+    if (!storage || !this._signals) return storage
+
+    const emitExpired = (error: unknown): void => {
+      const status = (error as { status?: number })?.status
+      if (status !== 401) return
+      this._signals?.emit('auth:expired', { status, entity: this.name })
+    }
+
+    return new Proxy(storage as IStorage<T> & object, {
+      get(target, prop, receiver) {
+        const value = Reflect.get(target, prop, receiver)
+        if (typeof value !== 'function') return value
+
+        return function (this: unknown, ...args: unknown[]) {
+          try {
+            const result = (value as (...a: unknown[]) => unknown).apply(
+              this === receiver ? target : this,
+              args
+            )
+            // Storage methods are async; a rejection is the normal error path.
+            if (result instanceof Promise) {
+              return result.catch((error: unknown) => {
+                emitExpired(error)
+                throw error
+              })
+            }
+            return result
+          } catch (error) {
+            emitExpired(error)
+            throw error
+          }
+        }
+      },
+    })
+  }
+
   /**
    * Normalize resolveStorage() return value to standard format
    */
@@ -367,7 +422,7 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
     // Function = dynamic endpoint builder
     if (typeof result === 'function') {
       return {
-        storage: this.storage,
+        storage: this._watchStorageAuth(this.storage),
         endpoint: result(context),
         isDynamic: true,
       }
@@ -375,18 +430,18 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
 
     // String = endpoint with primary storage
     if (typeof result === 'string') {
-      return { storage: this.storage, endpoint: result }
+      return { storage: this._watchStorageAuth(this.storage), endpoint: result }
     }
 
     // Null/undefined = primary storage
     if (!result) {
-      return { storage: this.storage }
+      return { storage: this._watchStorageAuth(this.storage) }
     }
 
     // Object with endpoint function = dynamic endpoint builder
     if (typeof result.endpoint === 'function') {
       return {
-        storage: result.storage || this.storage,
+        storage: this._watchStorageAuth(result.storage || this.storage),
         endpoint: result.endpoint(context),
         params: result.params,
         isDynamic: true,
@@ -396,14 +451,14 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
     // Object without storage = use primary storage
     if (!result.storage) {
       return {
-        storage: this.storage,
+        storage: this._watchStorageAuth(this.storage),
         endpoint: result.endpoint as string | undefined,
         params: result.params,
       }
     }
 
     return {
-      storage: result.storage,
+      storage: this._watchStorageAuth(result.storage ?? this.storage),
       endpoint: result.endpoint as string | undefined,
       params: result.params,
     }

package/src/kernel/Kernel.api.ts

@@ -46,7 +46,14 @@ export function applyApiMethods(KernelClass: { prototype: Kernel }): void {
           error: axiosError,
         })
 
-        if (status === 401 || status === 403) {
+        // 401 only, never 403 (#1905 lot F).
+        //
+        // A 403 says the session is valid and this door is closed. Logging the
+        // user out sends them to sign in again for a permission they will not
+        // have any more afterwards — a loop, not an error. The 403 still
+        // travels as api:error above, which is where a permission refusal
+        // belongs.
+        if (status === 401) {
           if (debug) {
             console.warn(
               `[Kernel] API ${status} error on ${url}, emitting auth:expired`

package/src/kernel/Kernel.auth.ts

@@ -51,8 +51,34 @@ export function applyAuthMethods(KernelClass: { prototype: Kernel }): void {
     const { authAdapter, onAuthExpired } = this.options
     if (!authAdapter) return
 
+    // A new session re-arms the guard below. Registered before the handler so
+    // the ordering is obvious to whoever reads this next.
+    this.signals!.on('auth:login', () => {
+      this._expiredHandled = false
+    })
+
     this.signals!.on('auth:expired', async (payload: { data: unknown }) => {
       const debug = this.options.debug ?? false
+
+      // One expiry per session (#1905 lot E).
+      //
+      // The handler logs out, emits auth:logout — which _setupAuthInvalidation
+      // turns into a full invalidateApp() — and redirects. Without this guard
+      // a page firing four requests that all 401 remounts the app four times
+      // while navigating to the login screen.
+      //
+      // Guarded on OUR OWN state, deliberately: an earlier draft tested
+      // `authAdapter.isAuthenticated()`, which would have skipped the very
+      // first signal for any consumer that clears its auth state before
+      // emitting — turning this fix into the silent no-op it exists to remove.
+      if (this._expiredHandled) {
+        if (debug) {
+          console.debug('[Kernel] auth:expired already handled for this session, ignoring')
+        }
+        return
+      }
+      this._expiredHandled = true
+
       if (debug) {
         console.warn('[Kernel] auth:expired received:', payload)
       }

package/src/kernel/Kernel.registries.ts

@@ -34,6 +34,12 @@ export function applyRegistryMethods(KernelClass: { prototype: Kernel }): void {
    * mounted on the same Vue app.
    */
   proto._createSignalBus = function (this: Self): void {
+    // Idempotent (#1905 lot B): the constructor builds the bus so consumers can
+    // wire it immediately. Replacing it here would orphan every listener
+    // registered between construction and createApp() — silently, which is
+    // exactly the failure mode this lot exists to remove.
+    if (this.signals) return
+
     if (this.options.existingSignals) {
       this.signals = this.options.existingSignals
       return

package/src/kernel/Kernel.ts

@@ -84,6 +84,15 @@ export class Kernel {
   options: KernelOptions
   vueApp: App | null = null
   router: Router | null = null
+  /**
+   * Available from construction, not from createApp() (#1905 lot B).
+   *
+   * It used to be null until createApp(), so wiring `kernel.signals` right
+   * after `new Kernel()` — the natural place — silently did nothing:
+   * `null?.emit?.()` does not throw. The bus has no dependencies, so the
+   * window existed for no reason. Removing it beats warning about it
+   * (ADR 0011).
+   */
   signals: SignalBus | null = null
   orchestrator: Orchestrator | null = null
   zoneRegistry: ZoneRegistry | null = null
@@ -100,6 +109,8 @@ export class Kernel {
   activeStack: ActiveStack | null = null
   stackHydrator: StackHydrator | null = null
   notificationStore: NotificationStore | null = null
+  /** One auth:expired per session — see Kernel.auth.ts (#1905). */
+  _expiredHandled = false
   i18nInstance: I18n | null = null
 
   /** Pending provides from modules (applied after vueApp creation) */
@@ -149,6 +160,12 @@ export class Kernel {
     }
 
     this.options = options
+
+    // The bus exists from here on (#1905 lot B). It has no dependencies, and
+    // the natural place to wire it is right after `new Kernel()` — so it must
+    // be usable there. _createSignalBus() is idempotent, so the later call in
+    // createApp() keeps this instance rather than orphaning its listeners.
+    this._createSignalBus()
   }
 
   /**