@steve31415/baselib 3.44.0 → 3.45.0

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import type { Context } from 'hono';
-import type { Logger } from './log-core.js';
+import { type Logger } from './log-core.js';
 import { ServiceCaller, S2sOptions } from './s2s.js';
 export declare const DEFAULT_AUTH_URL = "https://auth.apps.snewman.net";
 export declare const SESSION_COOKIE = "pw_session";

package/dist/auth.js

@@ -9,7 +9,11 @@
 //      policy, app-level checks) still runs.
 //   2. Authorization: Bearer → service-to-service OIDC (s2s.ts).
 //   3. pw_session cookie → whoami call to the auth service, cached
-//      in-instance (10 min hits / 30 s misses — the old-world numbers).
+//      in-instance (10 min hits / 30 s misses — the old-world numbers),
+//      one call per cookie at a time (concurrent misses share it).
+//      Every call (never a cache hit) logs one INFO 'session check' event
+//      saying why the cache could not answer and what the call cost the
+//      waiting request (~/migration/research/whoami-latency-2026-10-30.md).
 //
 // Then the user-access policy: by default an app admits only users whose
 // auth role is 'owner'; `userAccess: 'invited'` admits any active fleet
@@ -25,6 +29,7 @@
 import { createHash } from 'node:crypto';
 import { createMiddleware } from 'hono/factory';
 import { authMode } from './config.js';
+import { truncate } from './log-core.js';
 import { RateLimiter, resolveS2sCaller } from './s2s.js';
 export const DEFAULT_AUTH_URL = 'https://auth.apps.snewman.net';
 export const SESSION_COOKIE = 'pw_session';
@@ -46,6 +51,13 @@ export function requireIdentity(opts) {
     const policy = opts.userAccess ?? 'owner';
     const limiter = new RateLimiter(opts.rateLimitPerMin ?? 600);
     const cache = new Map();
+    // The whoami call in flight per cache key (single-flight).
+    const inFlight = new Map();
+    // Session-check log state (per middleware, like the cache): cache hits
+    // since the last whoami call, and when the last call ended.
+    let hitsSinceLastCall = 0;
+    let callCount = 0;
+    let lastCallEndedAt;
     const isApi = opts.isApiRequest ??
         ((c) => c.req.path.startsWith('/api/') || (c.req.header('accept') ?? '').includes('application/json'));
     const unauthenticated = (c) => {
@@ -108,18 +120,77 @@ export function requireIdentity(opts) {
         const key = createHash('sha256').update(cookieHeader).digest('hex');
         const cached = cache.get(key);
         if (cached && cached.expires > Date.now()) {
+            hitsSinceLastCall++;
             if (!cached.user)
                 return unauthenticated(c);
             return admit(cached.user);
         }
+        // Single-flight: a request that misses while a call for the same cookie
+        // is already in flight shares that call's answer instead of making its
+        // own (30% of calls were such duplicates). Every request still gets an
+        // answer fetched during its own lifetime, so what is admitted does not
+        // change; the answer is applied per request below.
+        const flight = inFlight.get(key);
+        if (flight) {
+            flight.joiners.count++;
+            return settle(await flight.outcome);
+        }
+        const joiners = { count: 0 };
+        const outcome = callWhoami(c, key, cached, cookieHeader, joiners).finally(() => inFlight.delete(key));
+        inFlight.set(key, { outcome, joiners });
+        return settle(await outcome);
+        function settle(outcome) {
+            if (outcome.kind === 'user')
+                return admit(outcome.user);
+            if (outcome.kind === 'unauthenticated')
+                return unauthenticated(c);
+            return c.json({ error: 'auth service unavailable' }, 503);
+        }
+    });
+    // One whoami call, whose answer every request that joined it shares. The
+    // waiting request pays its full latency. One INFO event per call (a few
+    // hundred a day fleet-wide; never per hit or per joined request), with a
+    // fixed vocabulary of keys and nothing from the cookie but how many
+    // cookies the header carries (a changing header defeats the cache).
+    async function callWhoami(c, key, cached, cookieHeader, joiners) {
+        const started = Date.now();
+        const cacheState = !cached ? 'absent' : cached.user ? 'expired-user' : 'expired-unauthenticated';
+        const callFields = {
+            cacheState,
+            ...(cached ? { entryAgeMs: started - cached.filled } : {}),
+            hitsSinceLastCall,
+            ...(lastCallEndedAt !== undefined ? { sinceLastCallMs: started - lastCallEndedAt } : {}),
+            ...(callCount === 0 ? { firstCall: true } : {}),
+            uptimeMs: Math.round(process.uptime() * 1000),
+            method: c.req.method,
+            path: truncate(c.req.path, 200),
+            upgrade: (c.req.header('upgrade') ?? '').toLowerCase() === 'websocket',
+            cookieCount: cookieHeader.split(';').filter((part) => part.includes('=')).length,
+        };
+        hitsSinceLastCall = 0;
+        callCount++;
+        // `joinedRequests`: requests that shared this call (single-flight),
+        // counted when the call ends, so it includes every joiner.
+        const callEnded = (status) => {
+            const ended = Date.now();
+            lastCallEndedAt = ended;
+            opts.logger?.info('session check', {
+                ...callFields,
+                joinedRequests: joiners.count,
+                status,
+                elapsedMs: ended - started,
+            });
+        };
         let res;
         try {
             res = await whoamiFetch(`${authUrl}/api/whoami`, { headers: { cookie: cookieHeader } });
         }
         catch (err) {
+            callEnded(0);
             opts.logger?.error('auth service unreachable', { error: err });
-            return c.json({ error: 'auth service unavailable' }, 503);
+            return { kind: 'unavailable' };
         }
+        callEnded(res.status);
         if (res.ok) {
             const data = (await res.json());
             const role = parseRole(data.role);
@@ -128,19 +199,21 @@ export function requireIdentity(opts) {
                 // protocol change: a fault, not an "invited" answer. Fail closed,
                 // loudly, and without caching so recovery is instant.
                 opts.logger?.error('whoami answer has no role', { email: data.email, role: data.role });
-                return c.json({ error: 'auth service unavailable' }, 503);
+                return { kind: 'unavailable' };
             }
             const user = { type: 'user', email: data.email, name: data.name, userId: data.user_id, role };
-            cache.set(key, { expires: Date.now() + hitMs, user });
-            return admit(user);
+            const now = Date.now();
+            cache.set(key, { expires: now + hitMs, filled: now, user });
+            return { kind: 'user', user };
         }
         if (res.status === 401) {
-            cache.set(key, { expires: Date.now() + missMs });
-            return unauthenticated(c);
+            const now = Date.now();
+            cache.set(key, { expires: now + missMs, filled: now });
+            return { kind: 'unauthenticated' };
         }
         opts.logger?.error('auth service error', { meta_status: res.status });
-        return c.json({ error: 'auth service unavailable' }, 503);
-    });
+        return { kind: 'unavailable' };
+    }
 }
 // The fleet-wide "not enabled" page, in the auth service's plain style so
 // every app shows the same thing. Carries nothing but the request's host,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.44.0",
+  "version": "3.45.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",