@spfn/auth 0.3.0-beta.25 → 0.3.0-beta.27

package/dist/{machine-principals-CdEgxOB1.d.ts → machine-principals-BvRw8b8t.d.ts}

@@ -591,6 +591,12 @@ declare function completePasswordResetService(params: CompletePasswordResetParam
  * refuses the account's live records too, as `denied`, so they land in that row
  * of the table. See `denyAllActiveByUserId`; the three callers are the three
  * places that revoke every key at once.
+ *
+ * A poll may ask to wait (`waitMillis`). `waitForDeviceAuthAnswerService` then
+ * holds a pending record's request — before the route's transaction opens — until
+ * something answers it, the wait runs out, or the device hangs up, and only after
+ * that is the table above applied. A long poll answers exactly what a short poll
+ * sent at the same moment would, only sooner.
  */
 
 interface StartDeviceAuthParams {
@@ -645,10 +651,21 @@ interface PollDeviceAuthParams {
      * to run a WebAuthn ceremony in needs.
      */
     webProxy?: boolean;
+    /**
+     * How long this request already waited on the server, from the long-poll
+     * middleware. A pending answer subtracts it from the interval: the device
+     * has done that much of its waiting here.
+     */
+    waitedMillis?: number;
 }
 /** Nobody has answered yet. Not an error — the waiting device waits. */
 interface DeviceAuthPendingResult {
     status: 'pending';
+    /**
+     * How long to wait before polling again, less what the request already
+     * waited on the server — 0 once a long poll has waited at least the interval,
+     * so the device asks again at once.
+     */
     intervalMillis: number;
 }
 /**
@@ -3341,6 +3358,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     pollDeviceAuth: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             deviceCode: _sinclair_typebox.TString;
+            waitMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
         }>;
     }, {}, {
         status: "pending";

package/dist/nextjs/api.js

@@ -577,9 +577,9 @@ var loginRegisterInterceptor = {
       ctx.body.oldKeyId = oldKeyId;
     }
     delete ctx.body.remember;
-    ctx.metadata.privateKey = keyPair.privateKey;
-    ctx.metadata.keyId = keyPair.keyId;
-    ctx.metadata.algorithm = keyPair.algorithm;
+    ctx.metadata.newPrivateKey = keyPair.privateKey;
+    ctx.metadata.newKeyId = keyPair.keyId;
+    ctx.metadata.newAlgorithm = keyPair.algorithm;
     ctx.metadata.remember = remember;
     await next();
   },
@@ -598,9 +598,9 @@ var loginRegisterInterceptor = {
       const ttl = getSessionTtl(ctx.metadata.remember);
       const sessionData = {
         userId: userData.userId,
-        privateKey: ctx.metadata.privateKey,
-        keyId: ctx.metadata.keyId,
-        algorithm: ctx.metadata.algorithm,
+        privateKey: ctx.metadata.newPrivateKey,
+        keyId: ctx.metadata.newKeyId,
+        algorithm: ctx.metadata.newAlgorithm,
         ...bindingSessionFields(userData, ctx.request.headers["user-agent"])
       };
       const sealed = await sealSession(sessionData, ttl);
@@ -617,7 +617,7 @@ var loginRegisterInterceptor = {
       });
       ctx.setCookies.push({
         name: COOKIE_NAMES.SESSION_KEY_ID,
-        value: ctx.metadata.keyId,
+        value: ctx.metadata.newKeyId,
         options: {
           httpOnly: true,
           secure: cookieSecure,
@@ -626,7 +626,7 @@ var loginRegisterInterceptor = {
           path: "/"
         }
       });
-      await pushCsrfCookie(ctx.setCookies, ctx.metadata.keyId, ttl);
+      await pushCsrfCookie(ctx.setCookies, ctx.metadata.newKeyId, ttl);
     } catch (error) {
       const err = error;
       authLogger.interceptor.login.error("Failed to save session", err);
@@ -693,11 +693,11 @@ function challengeSecretOf(body) {
   return typeof secret === "string" ? secret : void 0;
 }
 async function pendingKeyFor(ctx) {
-  if (ctx.metadata.privateKey && ctx.metadata.keyId) {
+  if (ctx.metadata.newPrivateKey && ctx.metadata.newKeyId) {
     return {
-      privateKey: ctx.metadata.privateKey,
-      keyId: ctx.metadata.keyId,
-      algorithm: ctx.metadata.algorithm
+      privateKey: ctx.metadata.newPrivateKey,
+      keyId: ctx.metadata.newKeyId,
+      algorithm: ctx.metadata.newAlgorithm
     };
   }
   const oauthPending = ctx.cookies.get(COOKIE_NAMES.OAUTH_PENDING);
@@ -825,6 +825,9 @@ function refuseAsContextChanged(ctx) {
 function isKeyExpiredRefusal(body) {
   return body?.__type === "KeyExpiredError";
 }
+function sessionQueued(setCookies) {
+  return setCookies.some((cookie) => cookie.name === COOKIE_NAMES.SESSION);
+}
 var generalAuthInterceptor = {
   pathPattern: "*",
   // Match all paths, filter by requiresAuth()
@@ -953,7 +956,7 @@ var generalAuthInterceptor = {
         }
       });
       pushCsrfCookieRemoval(ctx.setCookies);
-    } else if (ctx.metadata.refreshSession && ctx.response.status === 200) {
+    } else if (ctx.metadata.refreshSession && ctx.response.status === 200 && !sessionQueued(ctx.setCookies)) {
       try {
         const sessionData = ctx.metadata.sessionData;
         const ttl = getSessionTtl();