@remit/web-client 0.0.36 → 0.0.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/web-client",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "type": "module",
   "description": "Remit web client, published as composable primitives — the app shell, auth shells, and runtime config. A distributor imports what it composes and bundles it.",
   "exports": {
@@ -29,7 +29,7 @@
     "build:dist": "npm run generate:routes && node --import tsx harness/build.mjs",
     "preview": "vite preview",
     "test:typecheck": "npm run generate:routes && tsgo --noEmit",
-    "test:run": "node --import tsx --import ./test-support/register.mjs --test 'src/**/*.test.ts'",
+    "test:run": "node --import tsx --import ./test-support/register.mjs --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=50 --test 'src/**/*.test.ts'",
     "test": "npm run test:typecheck && npm run test:run"
   },
   "peerDependencies": {

package/src/auth/better-auth-config.ts

@@ -1,5 +1,5 @@
 import { createAuthClient } from "better-auth/react";
-import { taggedFetch } from "../lib/network-error";
+import { NetworkError, taggedFetch } from "../lib/network-error";
 import { getRuntimeConfig } from "../runtime-config";
 
 /**
@@ -185,18 +185,47 @@ const isFresh = (token: CachedToken): boolean =>
 const isUsable = (token: CachedToken): boolean =>
 	token.expiresAt > nowSeconds();
 
+/**
+ * A mint failure the held token is allowed to ride out: a request timeout (408),
+ * throttling (429), a server-side fault (5xx), or a transport failure that never
+ * reached the server. These say nothing about the session's validity, so keeping
+ * the token the tab already holds is correct. A 4xx that is not 408 or 429 does
+ * not qualify — least of all a 401/403, which is the server revoking the session.
+ */
+const isTransientMintFailure = (error: unknown): boolean => {
+	if (error instanceof NetworkError) return true;
+	if (error instanceof AuthTokenError) {
+		return (
+			error.status === 408 || error.status === 429 || (error.status ?? 0) >= 500
+		);
+	}
+	return false;
+};
+
+/**
+ * The mint was refused because the session is no longer valid. The held token is
+ * signed for that same revoked session, so it must be discarded rather than
+ * served until it expires.
+ */
+const isRevocation = (error: unknown): boolean =>
+	error instanceof AuthTokenError &&
+	(error.status === 401 || error.status === 403);
+
 /**
  * Return a valid RS256 JWT for the current session, minting a fresh one only
  * when the cached token is missing or within the skew window of expiry. The API
  * interceptor attaches it as a Bearer token; the backend verifies it against the
  * JWKS.
  *
- * A throttled or failed refresh never discards a token that is still usable: the
- * request keeps the session it already holds and the endpoint is left alone
- * until the backoff clears. Only a mint with nothing usable to fall back to
- * throws — returning null would put the request on the wire without an
- * Authorization header, and the backend answers that with a 401 that names a
- * missing token rather than the mint that failed.
+ * A throttled, faulted, or unreachable refresh never discards a token that is
+ * still usable: the request keeps the session it already holds and the endpoint
+ * is left alone until the backoff clears. A revocation (401/403) is the opposite
+ * — the session behind the held token is gone, so it is cleared and the failure
+ * propagates to re-authentication rather than serving a dead token until expiry.
+ * Only a mint with nothing usable to fall back to throws otherwise — returning
+ * null would put the request on the wire without an Authorization header, and the
+ * backend answers that with a 401 that names a missing token rather than the mint
+ * that failed.
  */
 export const fetchBetterAuthToken = async (): Promise<string> => {
 	const current = currentCache();
@@ -212,7 +241,11 @@ export const fetchBetterAuthToken = async (): Promise<string> => {
 	try {
 		return await mint();
 	} catch (error) {
-		if (current && isUsable(current)) {
+		if (isRevocation(error)) {
+			resetBetterAuthTokenCache();
+			throw error;
+		}
+		if (current && isUsable(current) && isTransientMintFailure(error)) {
 			backoffUntil = nowSeconds() + REFRESH_BACKOFF_SECONDS;
 			return current.value;
 		}

package/src/auth/better-auth-token.test.ts

@@ -197,6 +197,134 @@ describe("fetchBetterAuthToken", () => {
 		assert.equal(second, held);
 	});
 
+	test("a network failure keeps the still-valid token instead of discarding it", async () => {
+		const seed = stubTokenEndpoint(() =>
+			tokenResponse(nearExpiryJwt("still-valid")),
+		);
+		seed.release();
+		const held = await fetchBetterAuthToken();
+
+		globalThis.fetch = (async () => {
+			throw new TypeError("Failed to fetch");
+		}) as typeof fetch;
+		const afterNetworkFailure = await fetchBetterAuthToken();
+
+		assert.equal(afterNetworkFailure, held);
+	});
+
+	test("a 5xx refresh keeps the still-valid token instead of discarding it", async () => {
+		const seed = stubTokenEndpoint(() =>
+			tokenResponse(nearExpiryJwt("still-valid")),
+		);
+		seed.release();
+		const held = await fetchBetterAuthToken();
+
+		const faulted = stubTokenEndpoint(
+			() =>
+				new Response("", { status: 503, statusText: "Service Unavailable" }),
+		);
+		faulted.release();
+		const afterFault = await fetchBetterAuthToken();
+
+		assert.equal(faulted.calls, 1);
+		assert.equal(afterFault, held);
+	});
+
+	test("a 408 refresh keeps the still-valid token instead of discarding it", async () => {
+		const seed = stubTokenEndpoint(() =>
+			tokenResponse(nearExpiryJwt("still-valid")),
+		);
+		seed.release();
+		const held = await fetchBetterAuthToken();
+
+		const timedOut = stubTokenEndpoint(
+			() => new Response("", { status: 408, statusText: "Request Timeout" }),
+		);
+		timedOut.release();
+		const afterTimeout = await fetchBetterAuthToken();
+
+		assert.equal(timedOut.calls, 1);
+		assert.equal(afterTimeout, held);
+	});
+
+	test("an unclassified 4xx refresh throws without serving the held token", async () => {
+		const seed = stubTokenEndpoint(() =>
+			tokenResponse(nearExpiryJwt("still-valid")),
+		);
+		seed.release();
+		await fetchBetterAuthToken();
+
+		const rejected = stubTokenEndpoint(
+			() => new Response("", { status: 400, statusText: "Bad Request" }),
+		);
+		rejected.release();
+
+		await assert.rejects(
+			() => fetchBetterAuthToken(),
+			(error: unknown) => {
+				assert.ok(error instanceof AuthTokenError);
+				assert.equal(error.status, 400);
+				return true;
+			},
+		);
+		assert.equal(rejected.calls, 1);
+	});
+
+	test("a revoked mint (401) clears the held token and re-authenticates", async () => {
+		const seed = stubTokenEndpoint(() =>
+			tokenResponse(nearExpiryJwt("revoked-soon")),
+		);
+		seed.release();
+		const held = await fetchBetterAuthToken();
+
+		const revoked = stubTokenEndpoint(
+			() => new Response("", { status: 401, statusText: "Unauthorized" }),
+		);
+		revoked.release();
+		await assert.rejects(
+			() => fetchBetterAuthToken(),
+			(error: unknown) => {
+				assert.ok(error instanceof AuthTokenError);
+				assert.equal(error.status, 401);
+				return true;
+			},
+		);
+		assert.equal(revoked.calls, 1);
+
+		const reissued = stubTokenEndpoint(() => tokenResponse(jwt("reissued")));
+		reissued.release();
+		const afterReauth = await fetchBetterAuthToken();
+
+		assert.equal(reissued.calls, 1);
+		assert.notEqual(afterReauth, held);
+	});
+
+	test("a revoked mint (403) clears the held token and re-authenticates", async () => {
+		const seed = stubTokenEndpoint(() =>
+			tokenResponse(nearExpiryJwt("forbidden-soon")),
+		);
+		seed.release();
+		await fetchBetterAuthToken();
+
+		const forbidden = stubTokenEndpoint(
+			() => new Response("", { status: 403, statusText: "Forbidden" }),
+		);
+		forbidden.release();
+		await assert.rejects(
+			() => fetchBetterAuthToken(),
+			(error: unknown) => {
+				assert.ok(error instanceof AuthTokenError);
+				assert.equal(error.status, 403);
+				return true;
+			},
+		);
+
+		const reissued = stubTokenEndpoint(() => tokenResponse(jwt("reissued")));
+		reissued.release();
+		assert.ok(await fetchBetterAuthToken());
+		assert.equal(reissued.calls, 1);
+	});
+
 	test("a throttled refresh with no usable token to fall back on still throws", async () => {
 		const seed = stubTokenEndpoint(() =>
 			tokenResponse(jwtExpiringIn("already-expired", -10)),