@scalemule/news-publication 0.0.73 → 0.0.74

package/dist/reader-sso-client.cjs

@@ -86,7 +86,7 @@ function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppresse
     if (!enabled || !hasSessionCookie || staleCookie) return;
     let cancelled = false;
     fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
-      if (!cancelled && body?.authenticated !== true) setStaleCookie(true);
+      if (!cancelled && (body?.authenticated !== true || body.session_upgrade_required === true)) setStaleCookie(true);
     }).catch(() => {
     });
     return () => {

package/dist/reader-sso-client.js

@@ -84,7 +84,7 @@ function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppresse
     if (!enabled || !hasSessionCookie || staleCookie) return;
     let cancelled = false;
     fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
-      if (!cancelled && body?.authenticated !== true) setStaleCookie(true);
+      if (!cancelled && (body?.authenticated !== true || body.session_upgrade_required === true)) setStaleCookie(true);
     }).catch(() => {
     });
     return () => {

package/dist/reader-sso.cjs

@@ -39,6 +39,8 @@ function readerSsoCookieNames(prefix) {
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
 var clear = (name) => ({ name, value: "", maxAge: 0 });
+var keepLocalValue = (token) => "keep:" + crypto.createHash("sha256").update(token).digest("hex");
+var keepsLocal = (checked, token) => Boolean(token && checked === keepLocalValue(token));
 function applyCookies(jar, cookies) {
   for (const cookie of cookies) {
     jar.set(cookie.name, cookie.value, {
@@ -195,13 +197,13 @@ async function startSignIn(config, input) {
   if (input.cookies(c.names.session)) {
     const current = await currentUser(c, input.cookies(c.names.session));
     if (current && current.email_verified) {
-      if (mode === "silent") return { ok: false, status: 204, error: "", reason: "session", redirect, cookies: [] };
+      if (mode === "silent" && (!current.needsSsoUpgrade || keepsLocal(input.cookies(c.names.ssoChecked), input.cookies(c.names.session)))) return { ok: false, status: 204, error: "", reason: "session", redirect, cookies: [] };
     } else {
       staleSession.push(clear(c.names.session), clear(c.names.pending));
     }
   }
   if (mode === "silent") {
-    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked)) {
+    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked) === "1") {
       return { ok: false, status: 204, error: "", reason: "suppressed", redirect, cookies: staleSession };
     }
   }
@@ -244,9 +246,10 @@ async function currentUser(c, token) {
   return {
     id: me.id,
     email_verified: me.email_verified === true,
-    full_name: typeof me.full_name === "string" ? me.full_name.trim().slice(0, 150) : "",
+    full_name: typeof me.full_name === "string" ? Array.from(me.full_name.trim()).slice(0, 150).join("") : "",
     locale: typeof me.locale === "string" && me.locale.length <= 35 ? me.locale : void 0,
-    time_zone: typeof me.time_zone === "string" && me.time_zone.length <= 64 ? me.time_zone : void 0
+    time_zone: typeof me.time_zone === "string" && me.time_zone.length <= 64 ? me.time_zone : void 0,
+    ...me.sso_session_bound === false ? { needsSsoUpgrade: true } : {}
   };
 }
 function issuedSession(response, now) {
@@ -326,7 +329,7 @@ async function completeSignIn(config, input) {
 async function establish(c, args) {
   const { session, flow, method, cookies } = args;
   const user = await currentUser(c, session.token);
-  if (!user || !user.email_verified) throw new Error("unverified");
+  if (!user || !user.email_verified || user.needsSsoUpgrade) throw new Error("unverified");
   const current = await currentUser(c, args.input.cookies(c.names.session));
   const decision = precedence(current, user);
   if (decision === "switch") {
@@ -337,7 +340,12 @@ async function establish(c, args) {
     });
     if (flow.mode === "silent") cookies.push(args.negativeCache);
     emit(c, { name: "reader_sso_check", properties: { outcome: "switch_offered", mode: flow.mode, transaction: flow.tx } });
-    return { kind: "redirect", location: `${c.accountPath}?switch=1`, cookies, outcome: "switch_offered", flow };
+    return { kind: "redirect", location: flow.mode === "silent" ? flow.returnTo || "/" : `${c.accountPath}?switch=1`, cookies, outcome: "switch_offered", flow };
+  }
+  const previousToken = args.input.cookies(c.names.session);
+  if (current && previousToken && previousToken !== session.token) {
+    const retired = await c.request("/v1/auth/logout", { method: "POST", body: { session_token: previousToken }, token: previousToken });
+    if (failed(retired) || retired.body?.success !== true) throw new Error("session retirement failed");
   }
   cookies.push({ name: c.names.session, value: session.token, expires: session.expiresAt }, clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.pending));
   emit(c, { name: "reader_signin_completed", properties: { method, mode: flow.mode, is_new: session.isNew ? "true" : "false", transaction: flow.tx } });
@@ -411,6 +419,11 @@ async function switchAccount(config, input) {
     }
   };
   if (input.choice === "stay") {
+    const token = input.cookies(c.names.session);
+    const current = await currentUser(c, token);
+    if (token && current?.email_verified && current.needsSsoUpgrade) {
+      cookies.push({ name: c.names.ssoChecked, value: keepLocalValue(token), maxAge: 90 * 86400 });
+    }
     await logout(pending.token);
     emit(c, { name: "reader_sso_check", properties: { outcome: "switch_declined", mode: pending.mode, transaction: pending.tx } });
     return { ok: true, choice: "stay", cookies, location: pending.returnTo || c.accountPath };
@@ -457,7 +470,7 @@ async function sessionSummary(config, cookies) {
   const c = resolve(config);
   const user = await currentUser(c, cookies(c.names.session));
   if (!user || !user.email_verified) return { authenticated: false };
-  return { authenticated: true, full_name: user.full_name, locale: user.locale, time_zone: user.time_zone };
+  return { authenticated: true, full_name: user.full_name, locale: user.locale, time_zone: user.time_zone, ...user.needsSsoUpgrade && !keepsLocal(cookies(c.names.ssoChecked), cookies(c.names.session)) ? { session_upgrade_required: true } : {} };
 }
 async function sessionSummaryWithCookies(config, cookies) {
   const c = resolve(config);
@@ -468,7 +481,7 @@ async function sessionSummaryWithCookies(config, cookies) {
 function readerSsoBootFlags(cookies, names) {
   return {
     hasSession: Boolean(cookies(names.session)),
-    suppressed: Boolean(cookies(names.signedOut) || cookies(names.ssoChecked) || cookies(names.pending))
+    suppressed: Boolean(cookies(names.signedOut) || cookies(names.ssoChecked) === "1" || cookies(names.pending))
   };
 }
 

package/dist/reader-sso.d.cts

@@ -192,6 +192,7 @@ type SessionUser = {
     full_name: string;
     locale?: string;
     time_zone?: string;
+    needsSsoUpgrade?: true;
 };
 /** ADR 3.2: an active session for Bob is never replaced by Alice without an explicit choice. */
 declare function precedence(current: SessionUser | null, incoming: SessionUser): "replace" | "renew" | "switch";
@@ -298,6 +299,7 @@ type SessionSummary = {
     full_name: string;
     locale?: string;
     time_zone?: string;
+    session_upgrade_required?: true;
 };
 declare function sessionSummary(config: ReaderSsoConfig, cookies: CookieReader): Promise<SessionSummary>;
 /**

package/dist/reader-sso.d.ts

@@ -192,6 +192,7 @@ type SessionUser = {
     full_name: string;
     locale?: string;
     time_zone?: string;
+    needsSsoUpgrade?: true;
 };
 /** ADR 3.2: an active session for Bob is never replaced by Alice without an explicit choice. */
 declare function precedence(current: SessionUser | null, incoming: SessionUser): "replace" | "renew" | "switch";
@@ -298,6 +299,7 @@ type SessionSummary = {
     full_name: string;
     locale?: string;
     time_zone?: string;
+    session_upgrade_required?: true;
 };
 declare function sessionSummary(config: ReaderSsoConfig, cookies: CookieReader): Promise<SessionSummary>;
 /**

package/dist/reader-sso.js

@@ -24,6 +24,8 @@ function readerSsoCookieNames(prefix) {
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
 var clear = (name) => ({ name, value: "", maxAge: 0 });
+var keepLocalValue = (token) => "keep:" + createHash("sha256").update(token).digest("hex");
+var keepsLocal = (checked, token) => Boolean(token && checked === keepLocalValue(token));
 function applyCookies(jar, cookies) {
   for (const cookie of cookies) {
     jar.set(cookie.name, cookie.value, {
@@ -180,13 +182,13 @@ async function startSignIn(config, input) {
   if (input.cookies(c.names.session)) {
     const current = await currentUser(c, input.cookies(c.names.session));
     if (current && current.email_verified) {
-      if (mode === "silent") return { ok: false, status: 204, error: "", reason: "session", redirect, cookies: [] };
+      if (mode === "silent" && (!current.needsSsoUpgrade || keepsLocal(input.cookies(c.names.ssoChecked), input.cookies(c.names.session)))) return { ok: false, status: 204, error: "", reason: "session", redirect, cookies: [] };
     } else {
       staleSession.push(clear(c.names.session), clear(c.names.pending));
     }
   }
   if (mode === "silent") {
-    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked)) {
+    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked) === "1") {
       return { ok: false, status: 204, error: "", reason: "suppressed", redirect, cookies: staleSession };
     }
   }
@@ -229,9 +231,10 @@ async function currentUser(c, token) {
   return {
     id: me.id,
     email_verified: me.email_verified === true,
-    full_name: typeof me.full_name === "string" ? me.full_name.trim().slice(0, 150) : "",
+    full_name: typeof me.full_name === "string" ? Array.from(me.full_name.trim()).slice(0, 150).join("") : "",
     locale: typeof me.locale === "string" && me.locale.length <= 35 ? me.locale : void 0,
-    time_zone: typeof me.time_zone === "string" && me.time_zone.length <= 64 ? me.time_zone : void 0
+    time_zone: typeof me.time_zone === "string" && me.time_zone.length <= 64 ? me.time_zone : void 0,
+    ...me.sso_session_bound === false ? { needsSsoUpgrade: true } : {}
   };
 }
 function issuedSession(response, now) {
@@ -311,7 +314,7 @@ async function completeSignIn(config, input) {
 async function establish(c, args) {
   const { session, flow, method, cookies } = args;
   const user = await currentUser(c, session.token);
-  if (!user || !user.email_verified) throw new Error("unverified");
+  if (!user || !user.email_verified || user.needsSsoUpgrade) throw new Error("unverified");
   const current = await currentUser(c, args.input.cookies(c.names.session));
   const decision = precedence(current, user);
   if (decision === "switch") {
@@ -322,7 +325,12 @@ async function establish(c, args) {
     });
     if (flow.mode === "silent") cookies.push(args.negativeCache);
     emit(c, { name: "reader_sso_check", properties: { outcome: "switch_offered", mode: flow.mode, transaction: flow.tx } });
-    return { kind: "redirect", location: `${c.accountPath}?switch=1`, cookies, outcome: "switch_offered", flow };
+    return { kind: "redirect", location: flow.mode === "silent" ? flow.returnTo || "/" : `${c.accountPath}?switch=1`, cookies, outcome: "switch_offered", flow };
+  }
+  const previousToken = args.input.cookies(c.names.session);
+  if (current && previousToken && previousToken !== session.token) {
+    const retired = await c.request("/v1/auth/logout", { method: "POST", body: { session_token: previousToken }, token: previousToken });
+    if (failed(retired) || retired.body?.success !== true) throw new Error("session retirement failed");
   }
   cookies.push({ name: c.names.session, value: session.token, expires: session.expiresAt }, clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.pending));
   emit(c, { name: "reader_signin_completed", properties: { method, mode: flow.mode, is_new: session.isNew ? "true" : "false", transaction: flow.tx } });
@@ -396,6 +404,11 @@ async function switchAccount(config, input) {
     }
   };
   if (input.choice === "stay") {
+    const token = input.cookies(c.names.session);
+    const current = await currentUser(c, token);
+    if (token && current?.email_verified && current.needsSsoUpgrade) {
+      cookies.push({ name: c.names.ssoChecked, value: keepLocalValue(token), maxAge: 90 * 86400 });
+    }
     await logout(pending.token);
     emit(c, { name: "reader_sso_check", properties: { outcome: "switch_declined", mode: pending.mode, transaction: pending.tx } });
     return { ok: true, choice: "stay", cookies, location: pending.returnTo || c.accountPath };
@@ -442,7 +455,7 @@ async function sessionSummary(config, cookies) {
   const c = resolve(config);
   const user = await currentUser(c, cookies(c.names.session));
   if (!user || !user.email_verified) return { authenticated: false };
-  return { authenticated: true, full_name: user.full_name, locale: user.locale, time_zone: user.time_zone };
+  return { authenticated: true, full_name: user.full_name, locale: user.locale, time_zone: user.time_zone, ...user.needsSsoUpgrade && !keepsLocal(cookies(c.names.ssoChecked), cookies(c.names.session)) ? { session_upgrade_required: true } : {} };
 }
 async function sessionSummaryWithCookies(config, cookies) {
   const c = resolve(config);
@@ -453,7 +466,7 @@ async function sessionSummaryWithCookies(config, cookies) {
 function readerSsoBootFlags(cookies, names) {
   return {
     hasSession: Boolean(cookies(names.session)),
-    suppressed: Boolean(cookies(names.signedOut) || cookies(names.ssoChecked) || cookies(names.pending))
+    suppressed: Boolean(cookies(names.signedOut) || cookies(names.ssoChecked) === "1" || cookies(names.pending))
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.73",
+  "version": "0.0.74",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "main": "./dist/index.cjs",