@robosystems/core 0.11.2 → 0.11.4

package/auth-components/AuthProvider.js

@@ -4,17 +4,20 @@ import { createContext, useCallback, useContext, useEffect, useRef, useState, }
 import { clearEntitySelection } from '../actions/entity-actions';
 import { clearGraphSelection } from '../actions/graph-actions';
 import { performLogoutCleanup } from '../auth-core/cleanup';
-import { RoboSystemsAuthClient } from '../auth-core/client';
+import { isTransientError, RoboSystemsAuthClient } from '../auth-core/client';
 import { CURRENT_APP, isLoginHome } from '../auth-core/config';
 import { useTokenExpiryHandler } from '../auth-core/hooks';
 import { buildLoginHomeUrl, buildReturnTo } from '../auth-core/login-home';
-import { getTimeUntilExpiry, getTokenStatus } from '../auth-core/token-storage';
+import { getRefreshToken, getTimeUntilExpiry, getTokenStatus, TOKEN_REFRESH_GRACE_MS, } from '../auth-core/token-storage';
 // Configuration constants
 const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
 const TOKEN_REFRESH_INTERVAL_MS = 25 * 60 * 1000; // 25 minutes (5 min before 30 min expiry)
 const TOKEN_WARNING_CHECK_INTERVAL_MS = 30 * 1000; // 30 seconds - reduced for better battery life
 const ACTIVITY_THROTTLE_MS = 1000; // 1 second
 const HEARTBEAT_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes - server validation heartbeat
+const HEARTBEAT_BACKOFF_BASE_MS = 30 * 1000; // first retry after a transient heartbeat failure
+const SESSION_CHECK_MAX_RETRIES = 4; // page-load /me retries on a transient failure
+const SESSION_CHECK_BACKOFF_BASE_MS = 1000;
 const REFRESH_COOLDOWN_MS = 60 * 1000; // 60 seconds - prevent duplicate background refreshes
 const CACHE_VERSION = '1'; // Increment to invalidate all cached auth data
 // Debug logging helper
@@ -34,6 +37,18 @@ const logStorageError = (operation, error) => {
         console.error(message, error);
     }
 };
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Whether a failure is the server's final answer about this session: any
+ * 4xx but 429 (401 and 403 in practice). Outages, rate limits, network
+ * drops and malformed bodies are transient.
+ */
+const endsSession = (error) => !isTransientError(error);
+/**
+ * Seconds the warning dialog counts down: to the end of the refresh grace,
+ * the last moment a renewal can still succeed.
+ */
+const warningSeconds = (timeLeftMs) => Math.ceil((timeLeftMs + TOKEN_REFRESH_GRACE_MS) / 1000);
 const AuthContext = createContext(null);
 export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSYSTEMS_API_URL ||
     'http://localhost:8000', }) {
@@ -64,8 +79,14 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
                 }
             }
         }
-        catch (_a) {
-            // User not authenticated anymore, clear cache
+        catch (error) {
+            // Only the server refusing the session ends it. An outage, a rate
+            // limit or a network drop keeps the cached user; the heartbeat
+            // re-validates once the API answers again.
+            if (!endsSession(error)) {
+                debugLog('Cached user validation deferred (transient error)', error);
+                return;
+            }
             setUser(null);
             if (typeof window !== 'undefined') {
                 try {
@@ -80,7 +101,24 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
     }, [authClient]);
     const checkSession = useCallback(async () => {
         try {
-            const user = await authClient.getCurrentUser();
+            // A transient failure at page load (deploy, 5xx, 429, network) is
+            // retried with backoff instead of being read as "logged out".
+            let user = null;
+            for (let attempt = 0;; attempt++) {
+                try {
+                    user = await authClient.getCurrentUser();
+                    break;
+                }
+                catch (error) {
+                    if (!isTransientError(error) ||
+                        attempt >= SESSION_CHECK_MAX_RETRIES ||
+                        !mounted.current) {
+                        throw error;
+                    }
+                    authClient.clearAuthCache();
+                    await sleep(SESSION_CHECK_BACKOFF_BASE_MS * 2 ** attempt);
+                }
+            }
             setUser(user);
             // Cache the user data
             if (typeof window !== 'undefined') {
@@ -112,7 +150,15 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
     }, [authClient]);
     const logout = useCallback(async (reason, options) => {
         try {
-            await authClient.logout();
+            // An automatic logout (the server already refused the session)
+            // skips the server call: there is nothing left to revoke.
+            if (!(options === null || options === void 0 ? void 0 : options.skipServerLogout)) {
+                await authClient.logout();
+            }
+            else {
+                const { clearToken } = await import('../auth-core/token-storage');
+                clearToken();
+            }
         }
         catch (error) {
             // Logout error - continue with local logout regardless
@@ -213,6 +259,9 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             const response = await authClient.refreshSession();
             if (response.success) {
                 setUser(response.user);
+                // A renewed session has nothing left to warn about ("Stay Logged
+                // In" relies on this to dismiss the dialog).
+                setSessionWarning({ show: false, timeLeft: 0 });
                 // Cache the refreshed user data
                 if (typeof window !== 'undefined') {
                     try {
@@ -282,21 +331,81 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
         checkSession();
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
-    // Heartbeat - Server-side validation and background tab refresh
+    // Heartbeat - Server-side validation and background tab refresh.
+    //
+    // Only the server refusing the session (401, or 403 for a deactivated
+    // account) ends it, and then locally: the token is already dead, so there
+    // is no server logout to call. A network drop, a 5xx or a 429 keeps the
+    // session and backs off; focus events inside the backoff window are
+    // skipped so a flapping API is not hammered from every tab.
     useEffect(() => {
         if (!isAuthenticated)
             return;
         let isMounted = true;
-        const performHeartbeat = async () => {
-            if (!isMounted)
+        let inFlight = false;
+        let failures = 0;
+        let backoffUntil = 0;
+        let retryTimer = null;
+        let sentToken = null;
+        let recheckNow = false;
+        const tokenRotatedSince = (sent) => {
+            const current = getRefreshToken();
+            return current !== null && current !== sent;
+        };
+        const endSession = (reason) => logout(reason, { skipServerLogout: true });
+        const scheduleRetry = (error) => {
+            failures++;
+            const delay = Math.min(HEARTBEAT_BACKOFF_BASE_MS * 2 ** (failures - 1), HEARTBEAT_INTERVAL_MS);
+            debugLog(`Heartbeat: transient failure, retrying in ${Math.round(delay / 1000)}s`, error);
+            backoffUntil = Date.now() + delay;
+            if (retryTimer)
+                clearTimeout(retryTimer);
+            retryTimer = setTimeout(() => {
+                retryTimer = null;
+                performHeartbeat(true);
+            }, delay);
+        };
+        const performHeartbeat = async (scheduled = false) => {
+            if (!isMounted || inFlight)
+                return;
+            if (!scheduled && Date.now() < backoffUntil)
                 return;
+            inFlight = true;
             debugLog('Heartbeat: Checking server authentication status');
             try {
+                // A token that expired while the tab slept cannot authenticate
+                // /me, but the refresh endpoint still renews it within its grace
+                // window — so renew first.
+                if (getTokenStatus() === 'expired') {
+                    try {
+                        await refreshSession(true);
+                    }
+                    catch (refreshError) {
+                        if (!isMounted)
+                            return;
+                        if (endsSession(refreshError)) {
+                            await endSession('session_expired');
+                        }
+                        else {
+                            scheduleRetry(refreshError);
+                        }
+                        return;
+                    }
+                    // A refresh already in flight elsewhere skips this one; /me would
+                    // then go out unauthenticated and read as a refusal. Wait instead.
+                    if (getTokenStatus() === 'expired') {
+                        scheduleRetry(new Error('Session refresh still pending'));
+                        return;
+                    }
+                }
                 // Make real HTTP call to validate session server-side
                 // This works even in background tabs (not throttled like timers)
+                sentToken = getRefreshToken();
                 await authClient.getCurrentUser();
                 if (!isMounted)
                     return;
+                failures = 0;
+                backoffUntil = 0;
                 debugLog('Heartbeat: Server validation successful');
                 // After successful server check, verify local token status
                 const tokenStatus = getTokenStatus();
@@ -311,17 +420,19 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
                         if (!isMounted)
                             return;
                         debugLog('Heartbeat: Token refresh successful');
-                        setSessionWarning({ show: false, timeLeft: 0 });
                     }
                     catch (refreshError) {
                         if (!isMounted)
                             return;
                         debugLog('Heartbeat: Token refresh failed', refreshError);
-                        // Show warning if refresh failed but token not expired
-                        if (timeLeft > 0) {
+                        if (endsSession(refreshError)) {
+                            await endSession('session_expired');
+                        }
+                        else if (timeLeft > 0) {
+                            // Show warning if refresh failed but token not expired
                             setSessionWarning({
                                 show: true,
-                                timeLeft: Math.ceil(timeLeft / 1000),
+                                timeLeft: warningSeconds(timeLeft),
                             });
                         }
                     }
@@ -330,13 +441,33 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             catch (error) {
                 if (!isMounted)
                     return;
-                debugLog('Heartbeat: Server validation failed - user may be logged out', error);
-                // Server says we're not authenticated - immediate logout
-                await logout('session_invalid');
+                if (endsSession(error) && tokenRotatedSince(sentToken)) {
+                    // Another tab renewed the session while this check was in flight;
+                    // the refusal was for the token it replaced. Re-check at once.
+                    authClient.clearAuthCache();
+                    recheckNow = true;
+                }
+                else if (endsSession(error)) {
+                    debugLog('Heartbeat: Server refused the session', error);
+                    await endSession('session_invalid');
+                }
+                else {
+                    scheduleRetry(error);
+                }
+            }
+            finally {
+                inFlight = false;
+                if (recheckNow && isMounted) {
+                    recheckNow = false;
+                    retryTimer = setTimeout(() => {
+                        retryTimer = null;
+                        performHeartbeat(true);
+                    }, 0);
+                }
             }
         };
         // Regular heartbeat interval
-        const heartbeatInterval = setInterval(performHeartbeat, HEARTBEAT_INTERVAL_MS); // Every 5 minutes
+        const heartbeatInterval = setInterval(() => performHeartbeat(), HEARTBEAT_INTERVAL_MS); // Every 5 minutes
         // Also check immediately when tab regains focus
         const handleFocus = () => {
             if (!isMounted)
@@ -357,6 +488,8 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
         return () => {
             isMounted = false;
             clearInterval(heartbeatInterval);
+            if (retryTimer)
+                clearTimeout(retryTimer);
             window.removeEventListener('focus', handleFocus);
             document.removeEventListener('visibilitychange', handleVisibilityChange);
         };
@@ -383,19 +516,21 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
                     if (!isMounted)
                         return;
                     debugLog('Token refresh failed', error);
-                    // Show warning instead of silent logout
                     const timeLeft = getTimeUntilExpiry();
-                    if (timeLeft > 0) {
+                    if (endsSession(error)) {
+                        // The server refused the renewal: the session is over.
+                        debugLog('Refresh refused, redirecting to login');
+                        await logout('session_expired', { skipServerLogout: true });
+                    }
+                    else if (timeLeft > 0) {
+                        // Show warning instead of silent logout
                         setSessionWarning({
                             show: true,
-                            timeLeft: Math.ceil(timeLeft / 1000),
+                            timeLeft: warningSeconds(timeLeft),
                         });
                     }
-                    else {
-                        // Token is actually expired, need to re-authenticate
-                        debugLog('Token expired, redirecting to login');
-                        await logout('session_expired');
-                    }
+                    // A transient failure past expiry is left to the heartbeat,
+                    // which retries the renewal with backoff.
                 }
             }
         }, TOKEN_REFRESH_INTERVAL_MS); // Check every 25 minutes
@@ -418,11 +553,15 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
                 catch (error) {
                     if (!isMounted)
                         return;
+                    if (endsSession(error)) {
+                        await logout('session_expired', { skipServerLogout: true });
+                        return;
+                    }
                     // Auto-refresh failed, show warning modal
                     debugLog('Auto-refresh failed, showing warning modal', error);
                     setSessionWarning({
                         show: true,
-                        timeLeft: Math.ceil(timeLeft / 1000),
+                        timeLeft: warningSeconds(timeLeft),
                     });
                 }
             }
@@ -431,7 +570,7 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
                     return;
                 setSessionWarning({ show: false, timeLeft: 0 });
             }
-        }, TOKEN_WARNING_CHECK_INTERVAL_MS); // Check every 10 seconds
+        }, TOKEN_WARNING_CHECK_INTERVAL_MS); // Check every 30 seconds
         return () => {
             isMounted = false;
             clearInterval(refreshInterval);

package/auth-components/SessionWarningDialog.js

@@ -17,8 +17,8 @@ export function SessionWarningDialog() {
         const timer = setInterval(() => {
             setCountdown((prev) => {
                 if (prev <= 1) {
-                    // Time's up, logout
-                    logout();
+                    // Time's up: the session lapsed, it was not ended by the user
+                    logout('session_expired');
                     return 0;
                 }
                 return prev - 1;

package/auth-components/SignInForm.d.ts

@@ -14,7 +14,8 @@ export interface SignInFormProps {
  * request never reached the server — `fetch` throws a `TypeError`) must NOT be
  * reported as bad credentials: that sends users to reset a password that is
  * actually correct. Reached-server auth rejection (401/403, or an empty/invalid
- * auth body) stays "Invalid email or password"; 5xx gets its own message.
+ * auth body) stays "Invalid email or password"; 429 and 5xx get their own
+ * messages.
  */
 export declare function loginErrorMessage(error: unknown): string;
 /**

package/auth-components/SignInForm.js

@@ -4,23 +4,29 @@ import { useEffect, useMemo, useState } from 'react';
 import { RoboSystemsAuthClient } from '../auth-core/client';
 import { getAppConfig } from '../auth-core/config';
 import { useSSO } from '../auth-core/sso';
+import { ApiError } from '../lib/sdk-errors';
 import { LogoBadge, Spinner } from '../ui-components';
 /**
  * Map a login failure to a user-facing message. A connectivity failure (the
  * request never reached the server — `fetch` throws a `TypeError`) must NOT be
  * reported as bad credentials: that sends users to reset a password that is
  * actually correct. Reached-server auth rejection (401/403, or an empty/invalid
- * auth body) stays "Invalid email or password"; 5xx gets its own message.
+ * auth body) stays "Invalid email or password"; 429 and 5xx get their own
+ * messages.
  */
 export function loginErrorMessage(error) {
     var _a, _b, _c;
     const err = error;
     const status = (_a = err === null || err === void 0 ? void 0 : err.status) !== null && _a !== void 0 ? _a : (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.status;
     const message = String((_c = err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : '');
-    if (error instanceof TypeError ||
+    if ((error instanceof ApiError && error.isNetworkError) ||
+        error instanceof TypeError ||
         /failed to fetch|networkerror|load failed|fetch failed|err_(connection|network|name_not_resolved)/i.test(message)) {
         return 'Unable to reach the server. Check your connection and try again.';
     }
+    if (status === 429) {
+        return 'Too many sign-in attempts. Please wait a few minutes and try again.';
+    }
     if (typeof status === 'number' && status >= 500) {
         return 'The server ran into a problem. Please try again in a moment.';
     }

package/auth-components/SignUpForm.js

@@ -21,7 +21,10 @@ export function SignUpForm({ onSuccess, onRedirect, redirectTo = '/login', class
     const [invitation, setInvitation] = useState(null);
     const [inviteChecked, setInviteChecked] = useState(!inviteToken);
     const debounceRef = useRef(null);
-    const authClientRef = useRef(new RoboSystemsAuthClient(apiUrl));
+    // `useState`'s initializer runs once; `useRef(new …)` would construct a
+    // client on every render.
+    const [authClient] = useState(() => new RoboSystemsAuthClient(apiUrl));
+    const authClientRef = useRef(authClient);
     // Resolve the invitation before the form is usable. A token that no longer
     // resolves (revoked, expired, already accepted) degrades to ordinary
     // registration with a notice rather than a dead end.

package/auth-core/client.d.ts

@@ -1,4 +1,6 @@
+import { isSessionRejection, isTransientError } from '../lib/sdk-errors';
 import type { APIKey, AuthProviders, AuthResponse, AuthUser, CreateAPIKeyRequest, PasskeyEnrollmentResult, SSOTokenResponse } from './types';
+export { isSessionRejection, isTransientError };
 export declare class TokenExpiredError extends Error {
     constructor(message?: string);
 }
@@ -55,7 +57,12 @@ export declare class RoboSystemsAuthClient {
     private performAuthCheck;
     refreshSession(): Promise<AuthResponse>;
     /**
-     * Refresh session with exponential backoff retry logic
+     * Refresh session with exponential backoff retry logic.
+     *
+     * The request presents the stored token even when it has just expired:
+     * the API renews a recently-expired token within its grace window, and
+     * the data-call path deliberately stops sending it at expiry. A refusal
+     * (401/403) is final; only network errors, 429 and 5xx are retried.
      */
     private refreshSessionWithRetry;
     createAPIKey(request: CreateAPIKeyRequest): Promise<APIKey>;