@raisindb/client 0.4.5 → 0.4.6

package/dist/index.mjs

@@ -239,7 +239,7 @@ var LocalStorageTokenStorage = class {
 function isJwtCredentials(credentials) {
   return "type" in credentials && credentials.type === "jwt";
 }
-var AuthManager = class {
+var AuthManager = class _AuthManager {
   constructor(storage) {
     this.expiresAt = null;
     this._storage = storage ?? new MemoryTokenStorage();
@@ -262,6 +262,31 @@ var AuthManager = class {
     this.expiresAt = Date.now() + expiresInMs;
     this.scheduleTokenRefresh(expiresInMs);
   }
+  /**
+   * Learn a bare token's expiry FROM THE TOKEN.
+   *
+   * `setTokens` is the only other writer of `expiresAt`, and it needs a whole
+   * `AuthenticateResponse`. Several paths hold nothing but a JWT string — a
+   * session restored from storage, `authenticate({type:'jwt'})`,
+   * `setIdentityTokens(token)` — and left `expiresAt` null. `isTokenExpired()`
+   * reads null as EXPIRED, so `isAuthenticated()` answered false for the whole
+   * life of every restored session, i.e. every page load after the first.
+   *
+   * It failed silently, and it had already been routed around three times
+   * rather than fixed: both HTTP send paths were made to stop consulting
+   * `isAuthenticated()` (see `request()` and `mcpStream()` in http-client),
+   * and Studio grew its own token parse to tell a 404 apart from a logged-out
+   * read. This is the missing writer those workarounds existed for.
+   *
+   * Same 60s safety margin as `setTokens`, so both writers agree on when a
+   * token stops counting as good.
+   *
+   * @param token - A JWT held in storage or handed to us
+   */
+  adoptToken(token) {
+    const exp = _AuthManager.parseToken(token)?.exp;
+    this.expiresAt = typeof exp === "number" ? exp * 1e3 - 6e4 : null;
+  }
   /**
    * Get current access token
    */
@@ -5834,6 +5859,7 @@ var RaisinHttpClient = class extends EventEmitter {
   async authenticate(credentials, repository) {
     if (isJwtCredentials(credentials)) {
       this.authManager.storage.setAccessToken(credentials.token);
+      this.authManager.adoptToken(credentials.token);
       if (repository) {
         try {
           const userInfo = await this.fetchCurrentUser(repository);
@@ -6240,6 +6266,7 @@ var RaisinHttpClient = class extends EventEmitter {
   setIdentityTokens(accessTokenOrResult, refreshToken) {
     if (typeof accessTokenOrResult === "string") {
       this.authManager.storage.setAccessToken(accessTokenOrResult);
+      this.authManager.adoptToken(accessTokenOrResult);
       if (refreshToken) this.authManager.storage.setRefreshToken(refreshToken);
       return;
     }
@@ -7360,6 +7387,7 @@ var _RaisinClient = class _RaisinClient extends EventEmitter2 {
   async authenticate(credentials) {
     if (isJwtCredentials(credentials)) {
       logger.info("[authenticate] Starting JWT authentication...");
+      this.authManager.adoptToken(credentials.token);
       const payload = { token: credentials.token };
       const response = await this.sendRequestInternal(
         payload,
@@ -7854,7 +7882,13 @@ var _RaisinClient = class _RaisinClient extends EventEmitter2 {
     logger.debug(`[scheduleAutoRefresh] Scheduling refresh in ${Math.round(clamped / 1e3 / 60)} minutes`);
     this._refreshTimer = setTimeout(async () => {
       logger.info("[autoRefresh] Auto-refreshing token...");
-      await this.refreshToken();
+      const user = await this.refreshToken();
+      if (!user) {
+        logger.error("[autoRefresh] Refresh failed, clearing session");
+        this.authManager.clear();
+        this._currentUser = null;
+        this._emitAuthEvent("SESSION_EXPIRED");
+      }
     }, clamped);
   }
   /**