@reflagged/shell 1.0.2 → 1.1.0

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "@reflagged/shell",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Shared app shell for Reflagged services — OIDC auth, SSO, app switcher",
   "type": "module",
   "sideEffects": false,
-  "files": ["src", "tsconfig.json", "README.md"],
+  "files": [
+    "src",
+    "tsconfig.json",
+    "README.md"
+  ],
   "publishConfig": {
     "access": "public"
   },

package/src/lib/api/oidc-callback.ts

@@ -81,6 +81,7 @@ export async function GET(req: Request): Promise<NextResponse> {
     tenantSlug: asString(claims.tenant_slug),
     orgSlug: asString(claims.org_slug),
     orgRole: asString(claims.org_role),
+    platformRole: asString(claims.platform_role),
     accessibleServices,
   })
 

package/src/lib/api/shell-info.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 
+import type { OidcSessionToken } from '../auth/oidc-config'
 import { OIDC_COOKIE, OIDC_SESSION_TTL, loadOidcEnv } from '../auth/oidc-config'
 import { signSessionCookie, verifySessionCookie } from '../auth/oidc-cookie'
 import { refreshAccessToken } from '../auth/oidc-refresh'
@@ -7,6 +8,41 @@ import { refreshAccessToken } from '../auth/oidc-refresh'
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
 
+// Renew the access token this many seconds before its declared expiry, so a
+// token about to lapse mid-request is refreshed up front rather than after a
+// guaranteed 401 round-trip.
+const REFRESH_SKEW_SECONDS = 30
+
+type Refreshed = NonNullable<Awaited<ReturnType<typeof refreshAccessToken>>>
+
+/**
+ * Re-sign the session cookie after a token refresh, PRESERVING every
+ * membership/workspace claim from the existing session. Only the token fields
+ * change — dropping orgRole/accessibleServices/tenantSlug/... here would
+ * silently degrade per-service entitlement gating and the workspace header
+ * after each refresh.
+ */
+function reSignSession(
+  authSecret: string,
+  session: OidcSessionToken,
+  refreshed: Refreshed,
+): Promise<string> {
+  return signSessionCookie(authSecret, {
+    sub: session.sub,
+    email: session.email,
+    name: session.name,
+    emailVerified: session.emailVerified,
+    tenantId: session.tenantId,
+    tenantSlug: session.tenantSlug,
+    orgSlug: session.orgSlug,
+    orgRole: session.orgRole,
+    accessibleServices: session.accessibleServices,
+    accessToken: refreshed.accessToken,
+    refreshToken: refreshed.refreshToken,
+    accessTokenExpiresAt: refreshed.accessTokenExpiresAt,
+  })
+}
+
 export async function GET(req: Request): Promise<NextResponse> {
   const env = loadOidcEnv()
   if (!env) return NextResponse.json({ error: 'oidc-not-configured' }, { status: 503 })
@@ -32,22 +68,38 @@ export async function GET(req: Request): Promise<NextResponse> {
       cache: 'no-store',
     })
 
-  let upstream = await callUpstream(session.accessToken)
+  let accessToken: string = session.accessToken
   let refreshedCookie: string | null = null
 
+  // Proactive refresh: if the access token has expired (or is within the skew
+  // window), renew it BEFORE calling upstream. The access token lives ~1h and
+  // the refresh token ~14d, so the App-Switcher menu stays alive for the whole
+  // session without burning a 401 round-trip or forcing a manual re-login.
+  const nowSeconds = Math.floor(Date.now() / 1000)
+  if (
+    session.refreshToken &&
+    typeof session.accessTokenExpiresAt === 'number' &&
+    session.accessTokenExpiresAt - REFRESH_SKEW_SECONDS <= nowSeconds
+  ) {
+    const refreshed = await refreshAccessToken(env, session.refreshToken)
+    if (refreshed) {
+      refreshedCookie = await reSignSession(env.authSecret, session, refreshed)
+      session = { ...session, ...refreshed }
+      accessToken = refreshed.accessToken
+    }
+  }
+
+  let upstream = await callUpstream(accessToken)
+
+  // Reactive backstop: the token was rejected before its declared expiry
+  // (revoked, clock skew, rotated elsewhere) — try one refresh and retry.
   if (upstream.status === 401 && session.refreshToken) {
     const refreshed = await refreshAccessToken(env, session.refreshToken)
     if (refreshed) {
+      refreshedCookie = await reSignSession(env.authSecret, session, refreshed)
       session = { ...session, ...refreshed }
-      refreshedCookie = await signSessionCookie(env.authSecret, {
-        sub: session.sub,
-        email: session.email,
-        name: session.name,
-        accessToken: refreshed.accessToken,
-        refreshToken: refreshed.refreshToken,
-        accessTokenExpiresAt: refreshed.accessTokenExpiresAt,
-      })
-      upstream = await callUpstream(refreshed.accessToken)
+      accessToken = refreshed.accessToken
+      upstream = await callUpstream(accessToken)
     }
   }
 

package/src/lib/auth/oidc-config.ts

@@ -17,6 +17,16 @@ export type OidcSessionToken = {
   tenantSlug?: string | null
   orgSlug?: string | null
   orgRole?: string | null
+  /**
+   * The platform-wide role (`superadmin` · `reflagged_admin` · `tenant_admin`
+   * · `member`), beside `org_role` rather than behind it.
+   *
+   * `org_role` is emitted as `membership ?? platform`, which drops the second
+   * one: a `superadmin` carried as `member` in their own organisation looks
+   * like an ordinary member to a service. A service deriving rights from the
+   * token would lock them out of their own instance at the next sign-in.
+   */
+  platformRole?: string | null
   /** Product keys the user may access; ['*'] = all, [] = none. */
   accessibleServices?: string[] | null
   iat: number

package/src/lib/auth/oidc-cookie.ts

@@ -22,6 +22,7 @@ export async function signSessionCookie(
     tenantSlug?: string | null
     orgSlug?: string | null
     orgRole?: string | null
+    platformRole?: string | null
     accessibleServices?: string[] | null
   },
 ): Promise<string> {
@@ -36,6 +37,7 @@ export async function signSessionCookie(
     tenantSlug: payload.tenantSlug ?? null,
     orgSlug: payload.orgSlug ?? null,
     orgRole: payload.orgRole ?? null,
+    platformRole: payload.platformRole ?? null,
     accessibleServices: payload.accessibleServices ?? null,
   })
     .setProtectedHeader({ alg: ALG })
@@ -65,6 +67,7 @@ export async function verifySessionCookie(
       tenantSlug: typeof payload.tenantSlug === 'string' ? payload.tenantSlug : null,
       orgSlug: typeof payload.orgSlug === 'string' ? payload.orgSlug : null,
       orgRole: typeof payload.orgRole === 'string' ? payload.orgRole : null,
+      platformRole: typeof payload.platformRole === 'string' ? payload.platformRole : null,
       accessibleServices: Array.isArray(payload.accessibleServices)
         ? (payload.accessibleServices as unknown[]).filter((s): s is string => typeof s === 'string')
         : null,