@svadmin/sso 0.10.0 → 0.11.0

package/dist/session-manager.js

@@ -0,0 +1,566 @@
+import { isTerminalSessionError, SSOAuthError } from './errors.js';
+const AUTO_REFRESH_RETRY_DELAY_MS = 30_000;
+const processRefreshLockTails = new WeakMap();
+function createStorageKeys(storageKey) {
+    return {
+        tokens: `${storageKey}_tokens`,
+        pkceVerifier: `${storageKey}_pkce_verifier`,
+        state: `${storageKey}_state`,
+    };
+}
+function parseSession(raw) {
+    if (!raw)
+        return null;
+    try {
+        const value = JSON.parse(raw);
+        if (typeof value.access_token !== 'string'
+            || !value.access_token
+            || typeof value.token_type !== 'string'
+            || !value.token_type
+            || (value.id_token !== undefined && typeof value.id_token !== 'string')
+            || (value.refresh_token !== undefined && typeof value.refresh_token !== 'string')
+            || (value.expires_at !== undefined
+                && (typeof value.expires_at !== 'number' || !Number.isFinite(value.expires_at)))) {
+            return null;
+        }
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+function isTerminalRefreshError(error) {
+    if (isTerminalSessionError(error))
+        return true;
+    return error instanceof SSOAuthError
+        && error.statusCode >= 400
+        && error.statusCode < 500
+        && !error.retryable;
+}
+function normalizeTerminalRefreshError(error) {
+    if (!(error instanceof SSOAuthError) || isTerminalSessionError(error))
+        return error;
+    return new SSOAuthError(error.message, error.statusCode, {
+        code: 'session_refresh_failed',
+        details: error.details,
+        body: error.body,
+        retryable: false,
+        cause: error,
+    });
+}
+function getBrowserRefreshLock() {
+    if (typeof window === 'undefined' || !window.navigator?.locks)
+        return undefined;
+    return {
+        request(name, operation) {
+            return window.navigator.locks.request(name, operation);
+        },
+    };
+}
+function getBroadcastChannel(name) {
+    if (typeof window === 'undefined' || typeof window.BroadcastChannel !== 'function') {
+        return null;
+    }
+    try {
+        return new window.BroadcastChannel(name);
+    }
+    catch {
+        return null;
+    }
+}
+function hasStorageEvents() {
+    return typeof window !== 'undefined'
+        && typeof window.addEventListener === 'function'
+        && typeof window.removeEventListener === 'function';
+}
+function clearStorageValue(storage, key) {
+    try {
+        storage.removeItem(key);
+        return null;
+    }
+    catch (removeError) {
+        try {
+            storage.setItem(key, '');
+            return null;
+        }
+        catch {
+            return removeError;
+        }
+    }
+}
+function createProcessRefreshLock(storage) {
+    return {
+        async request(name, operation) {
+            const tails = processRefreshLockTails.get(storage) ?? new Map();
+            processRefreshLockTails.set(storage, tails);
+            const previous = tails.get(name) ?? Promise.resolve();
+            let release;
+            const current = new Promise((resolve) => { release = resolve; });
+            tails.set(name, current);
+            await previous.catch(() => undefined);
+            try {
+                return await operation();
+            }
+            finally {
+                release();
+                if (tails.get(name) === current)
+                    tails.delete(name);
+            }
+        },
+    };
+}
+function createUnavailableBrowserRefreshLock() {
+    return {
+        request() {
+            return Promise.reject(new Error('This browser does not provide Web Locks; configure an atomic cross-context refreshLock'));
+        },
+    };
+}
+function isBrowserRuntime() {
+    return typeof window !== 'undefined' && typeof window.document !== 'undefined';
+}
+export function createSessionManager(options) {
+    const keys = createStorageKeys(options.storageKey);
+    const legacyKeys = options.legacyStorageKey && options.legacyStorageKey !== options.storageKey
+        ? createStorageKeys(options.legacyStorageKey)
+        : null;
+    const refreshLockName = `${options.storageKey}:refresh`;
+    const authLockName = `${options.storageKey}:auth`;
+    const lock = options.refreshLock
+        ?? getBrowserRefreshLock()
+        ?? (isBrowserRuntime()
+            ? createUnavailableBrowserRefreshLock()
+            : createProcessRefreshLock(options.storage));
+    const listeners = new Set();
+    const channel = getBroadcastChannel(`${options.storageKey}:auth`);
+    let refreshTimer = null;
+    let refreshingPromise = null;
+    let destroyed = false;
+    let locallySignedOut = false;
+    let authGeneration = 0;
+    function hasPendingAuthAttempt() {
+        return options.storage.getItem(keys.state) !== null;
+    }
+    function getSessionSnapshot() {
+        const raw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
+        return { raw, session: parseSession(raw) };
+    }
+    function migrateLegacyStorage() {
+        if (!legacyKeys || options.storage.getItem(keys.tokens))
+            return;
+        const legacySession = options.storage.getItem(legacyKeys.tokens);
+        if (legacySession && parseSession(legacySession)) {
+            options.storage.setItem(keys.tokens, legacySession);
+            options.storage.removeItem(legacyKeys.tokens);
+        }
+        const legacyVerifier = options.storage.getItem(legacyKeys.pkceVerifier);
+        if (legacyVerifier && !options.storage.getItem(keys.pkceVerifier)) {
+            options.storage.setItem(keys.pkceVerifier, legacyVerifier);
+            options.storage.removeItem(legacyKeys.pkceVerifier);
+        }
+        const legacyState = options.storage.getItem(legacyKeys.state);
+        if (legacyState && !options.storage.getItem(keys.state)) {
+            options.storage.setItem(keys.state, legacyState);
+            options.storage.removeItem(legacyKeys.state);
+        }
+    }
+    migrateLegacyStorage();
+    let lastObservedRaw = options.storage.getItem(keys.tokens);
+    function getSession() {
+        return getSessionSnapshot().session;
+    }
+    function emit(event, session) {
+        if (destroyed)
+            return;
+        for (const listener of listeners) {
+            try {
+                const result = listener(event, session);
+                if (result && typeof result.then === 'function') {
+                    void Promise.resolve(result).catch((error) => {
+                        const message = error instanceof Error ? error.message : String(error);
+                        console.warn(`[svadmin/sso] async auth state listener failed: ${message}`);
+                    });
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.warn(`[svadmin/sso] auth state listener failed: ${message}`);
+            }
+        }
+    }
+    function broadcast(event, preserveAuthAttempt = false) {
+        if (destroyed)
+            return;
+        try {
+            channel?.postMessage({
+                storageKey: options.storageKey,
+                event,
+                ...(preserveAuthAttempt ? { preserveAuthAttempt: true } : {}),
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(`[svadmin/sso] auth state broadcast failed: ${message}`);
+        }
+    }
+    function clearRefreshTimer() {
+        if (refreshTimer) {
+            clearTimeout(refreshTimer);
+            refreshTimer = null;
+        }
+    }
+    function scheduleRefresh(session) {
+        clearRefreshTimer();
+        if (destroyed
+            || !options.autoRefresh
+            || !session?.refresh_token
+            || session.expires_at === undefined) {
+            return;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const delay = Math.max(0, session.expires_at - now - options.refreshBuffer) * 1000;
+        refreshTimer = setTimeout(runScheduledRefresh, delay);
+    }
+    function runScheduledRefresh() {
+        if (refreshTimer)
+            clearTimeout(refreshTimer);
+        refreshTimer = null;
+        void refreshSession().catch((error) => {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(`[svadmin/sso] automatic token refresh failed; session retained: ${message}`);
+            if (!destroyed
+                && error instanceof SSOAuthError
+                && error.retryable
+                && getSession()?.refresh_token) {
+                refreshTimer = setTimeout(runScheduledRefresh, AUTO_REFRESH_RETRY_DELAY_MS);
+            }
+        });
+    }
+    function saveSession(session, event) {
+        const raw = JSON.stringify(session);
+        try {
+            // 单次 setItem 写入完整 token set，避免轮换只落盘一半。
+            options.storage.setItem(keys.tokens, raw);
+        }
+        catch (error) {
+            clearStorageValue(options.storage, keys.tokens);
+            authGeneration += 1;
+            locallySignedOut = true;
+            lastObservedRaw = null;
+            clearRefreshTimer();
+            emit('SIGNED_OUT', null);
+            broadcast('SIGNED_OUT');
+            throw new SSOAuthError('Session could not be persisted', 0, {
+                code: 'session_persistence_failed',
+                retryable: false,
+                cause: error,
+            });
+        }
+        if (event !== 'TOKEN_REFRESHED')
+            authGeneration += 1;
+        locallySignedOut = false;
+        lastObservedRaw = raw;
+        scheduleRefresh(session);
+        if (event) {
+            emit(event, session);
+            broadcast(event);
+        }
+    }
+    function clearSession() {
+        const failures = [keys.tokens, keys.pkceVerifier, keys.state]
+            .map((key) => clearStorageValue(options.storage, key));
+        const persistenceFailure = failures.find((error) => error !== null);
+        authGeneration += 1;
+        locallySignedOut = true;
+        lastObservedRaw = null;
+        clearRefreshTimer();
+        emit('SIGNED_OUT', null);
+        broadcast('SIGNED_OUT');
+        if (persistenceFailure !== undefined && persistenceFailure !== null) {
+            throw new SSOAuthError('Session could not be cleared', 0, {
+                code: 'session_persistence_failed',
+                retryable: false,
+                cause: persistenceFailure,
+            });
+        }
+    }
+    function clearTokenSession() {
+        const persistenceFailure = clearStorageValue(options.storage, keys.tokens);
+        // 仅 token 失效不能取消已经持有 PKCE/state 的新认证尝试。
+        // 显式 logout 会走 clearSession()，仍会清理完整状态并推进 generation。
+        const preservesAuthAttempt = hasPendingAuthAttempt();
+        if (!preservesAuthAttempt) {
+            authGeneration += 1;
+            locallySignedOut = true;
+        }
+        lastObservedRaw = null;
+        clearRefreshTimer();
+        if (!preservesAuthAttempt)
+            emit('SIGNED_OUT', null);
+        broadcast('SIGNED_OUT', preservesAuthAttempt);
+        if (persistenceFailure !== null) {
+            throw new SSOAuthError('Session could not be cleared', 0, {
+                code: 'session_persistence_failed',
+                retryable: false,
+                cause: persistenceFailure,
+            });
+        }
+    }
+    function resolveRefreshRace(expectedRaw) {
+        const currentRaw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
+        if (currentRaw === expectedRaw)
+            return { changed: false };
+        if (currentRaw === null)
+            return { changed: true, session: null };
+        const currentSession = parseSession(currentRaw);
+        if (!currentSession) {
+            clearTokenSession();
+            throw new SSOAuthError('Stored session became invalid during token refresh', 0, {
+                code: 'session_refresh_failed',
+                retryable: false,
+            });
+        }
+        scheduleRefresh(currentSession);
+        return { changed: true, session: currentSession };
+    }
+    function setLoginState(verifier, state) {
+        options.storage.setItem(keys.pkceVerifier, verifier);
+        options.storage.setItem(keys.state, state);
+        authGeneration += 1;
+    }
+    function beginAuthAttempt() {
+        authGeneration += 1;
+    }
+    function beginSignOut() {
+        authGeneration += 1;
+        locallySignedOut = true;
+        clearRefreshTimer();
+    }
+    function clearLoginState(expectedState) {
+        if (expectedState !== undefined && options.storage.getItem(keys.state) !== expectedState) {
+            return;
+        }
+        options.storage.removeItem(keys.pkceVerifier);
+        options.storage.removeItem(keys.state);
+    }
+    async function runWithLock(name, operation, createLockError) {
+        let operationStarted = false;
+        try {
+            return await lock.request(name, async () => {
+                operationStarted = true;
+                return operation();
+            });
+        }
+        catch (error) {
+            if (operationStarted)
+                throw error;
+            throw createLockError(error);
+        }
+    }
+    function runWithRefreshLock(operation) {
+        return runWithLock(refreshLockName, operation, (cause) => new SSOAuthError('Token refresh lock could not be acquired', 0, {
+            code: 'refresh_lock_failed',
+            retryable: true,
+            cause,
+        }));
+    }
+    function runAuthMutation(operation) {
+        return runWithLock(authLockName, operation, (cause) => new SSOAuthError('Authentication coordination lock could not be acquired', 0, {
+            code: 'auth_lock_failed',
+            retryable: false,
+            cause,
+        }));
+    }
+    function resolveTerminalRefreshFailure(expectedRaw, error) {
+        const race = resolveRefreshRace(expectedRaw);
+        if (race.changed && race.session)
+            return race.session;
+        if (!race.changed)
+            clearTokenSession();
+        throw normalizeTerminalRefreshError(error);
+    }
+    function clearTokenSessionIfCurrent(expectedRaw) {
+        return runAuthMutation(async () => {
+            const race = resolveRefreshRace(expectedRaw);
+            if (race.changed)
+                return race.session;
+            clearTokenSession();
+            return null;
+        });
+    }
+    async function executeRefresh(initialRaw) {
+        return runWithRefreshLock(async () => {
+            const lockRace = resolveRefreshRace(initialRaw);
+            if (lockRace.changed)
+                return lockRace.session;
+            const latestSession = parseSession(initialRaw);
+            if (!latestSession?.refresh_token)
+                return null;
+            let refreshedSession;
+            try {
+                refreshedSession = await options.refresh(latestSession);
+            }
+            catch (error) {
+                if (isTerminalRefreshError(error)) {
+                    return runAuthMutation(async () => resolveTerminalRefreshFailure(initialRaw, error));
+                }
+                throw error;
+            }
+            // 网络请求只持有 refresh 锁；最终 CAS 与写入再短暂持有 auth 锁，
+            // 使跨标签页 logout/callback commit 与 token rotation 线性化。
+            return runAuthMutation(async () => {
+                const writeRace = resolveRefreshRace(initialRaw);
+                if (writeRace.changed)
+                    return writeRace.session;
+                saveSession(refreshedSession, 'TOKEN_REFRESHED');
+                return refreshedSession;
+            });
+        });
+    }
+    function refreshSession() {
+        if (refreshingPromise)
+            return refreshingPromise;
+        const initialRaw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
+        const initialSession = parseSession(initialRaw);
+        if (!initialRaw || !initialSession?.refresh_token) {
+            return Promise.resolve(null);
+        }
+        refreshingPromise = executeRefresh(initialRaw).finally(() => {
+            refreshingPromise = null;
+        });
+        return refreshingPromise;
+    }
+    async function getAccessToken(accessOptions = {}) {
+        const snapshot = getSessionSnapshot();
+        if (!snapshot.raw || !snapshot.session)
+            return null;
+        const { raw: initialRaw, session } = snapshot;
+        const minValiditySeconds = Math.max(0, accessOptions.minValiditySeconds ?? 0);
+        const now = Math.floor(Date.now() / 1000);
+        const expiresSoon = session.expires_at !== undefined
+            && session.expires_at <= now + minValiditySeconds;
+        if (!accessOptions.forceRefresh && !expiresSoon) {
+            return session.access_token;
+        }
+        if (!session.refresh_token) {
+            if (!expiresSoon)
+                return null;
+            const latestSession = await clearTokenSessionIfCurrent(initialRaw);
+            if (!latestSession)
+                return null;
+            const latestExpiresSoon = latestSession.expires_at !== undefined
+                && latestSession.expires_at <= now + minValiditySeconds;
+            if (!accessOptions.forceRefresh && !latestExpiresSoon) {
+                return latestSession.access_token;
+            }
+            if (!latestSession.refresh_token)
+                return null;
+            return (await refreshSession())?.access_token ?? null;
+        }
+        return (await refreshSession())?.access_token ?? null;
+    }
+    function syncRemoteChange(event, raw, force = false, preserveAuthAttempt = false) {
+        if (!force && raw === lastObservedRaw)
+            return;
+        if (raw === null) {
+            // token-only 失效可与新 callback 并发；共享 state 存在时不能把它误判为 logout。
+            const shouldPreserveAuthAttempt = preserveAuthAttempt && hasPendingAuthAttempt();
+            if (!shouldPreserveAuthAttempt) {
+                authGeneration += 1;
+                locallySignedOut = true;
+            }
+            lastObservedRaw = null;
+            clearRefreshTimer();
+            if (!shouldPreserveAuthAttempt)
+                emit('SIGNED_OUT', null);
+            return;
+        }
+        const session = parseSession(raw);
+        if (!session) {
+            syncRemoteChange('SIGNED_OUT', null);
+            return;
+        }
+        // 一次明确的本地登出只有当前上下文的新登录才能撤销；远端刷新不能复活它。
+        if (locallySignedOut)
+            return;
+        authGeneration += 1;
+        lastObservedRaw = raw;
+        scheduleRefresh(session);
+        emit(event, session);
+    }
+    function onBroadcastMessage(message) {
+        const data = message.data;
+        if (!data || data.storageKey !== options.storageKey)
+            return;
+        const currentRaw = options.storage.getItem(keys.tokens);
+        if (data.event === 'SIGNED_OUT') {
+            if (parseSession(currentRaw))
+                return;
+            syncRemoteChange('SIGNED_OUT', null, true, data.preserveAuthAttempt === true);
+            return;
+        }
+        if (data.event === 'TOKEN_REFRESHED' && currentRaw === null)
+            return;
+        syncRemoteChange(data.event, currentRaw);
+    }
+    function onStorage(event) {
+        if (event.key !== keys.tokens)
+            return;
+        const remoteSession = parseSession(event.newValue);
+        syncRemoteChange(remoteSession ? 'TOKEN_REFRESHED' : 'SIGNED_OUT', remoteSession ? event.newValue : null, !remoteSession, !remoteSession);
+    }
+    function onVisibilityChange() {
+        if (!options.autoRefresh || document.visibilityState !== 'visible')
+            return;
+        const session = getSession();
+        if (!session?.refresh_token || session.expires_at === undefined)
+            return;
+        const now = Math.floor(Date.now() / 1000);
+        if (session.expires_at <= now + options.refreshBuffer) {
+            runScheduledRefresh();
+        }
+        else {
+            scheduleRefresh(session);
+        }
+    }
+    channel?.addEventListener('message', onBroadcastMessage);
+    if (hasStorageEvents())
+        window.addEventListener('storage', onStorage);
+    if (typeof document !== 'undefined' && typeof document.addEventListener === 'function') {
+        document.addEventListener('visibilitychange', onVisibilityChange);
+    }
+    scheduleRefresh(parseSession(lastObservedRaw));
+    return {
+        getSession,
+        getAuthGeneration: () => authGeneration,
+        saveSession,
+        clearSession,
+        beginAuthAttempt,
+        beginSignOut,
+        setLoginState,
+        getPKCEVerifier: () => options.storage.getItem(keys.pkceVerifier),
+        getLoginState: () => options.storage.getItem(keys.state),
+        clearLoginState,
+        runAuthMutation,
+        refreshSession,
+        getAccessToken,
+        onAuthStateChange(callback) {
+            listeners.add(callback);
+            return () => listeners.delete(callback);
+        },
+        destroy() {
+            if (destroyed)
+                return;
+            destroyed = true;
+            clearRefreshTimer();
+            listeners.clear();
+            channel?.removeEventListener('message', onBroadcastMessage);
+            channel?.close();
+            if (hasStorageEvents())
+                window.removeEventListener('storage', onStorage);
+            if (typeof document !== 'undefined' && typeof document.removeEventListener === 'function') {
+                document.removeEventListener('visibilitychange', onVisibilityChange);
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -19,27 +19,27 @@
     "url": "https://github.com/zuohuadong/svadmin",
     "directory": "packages/sso"
   },
+  "sideEffects": false,
   "exports": {
     ".": {
-      "types": "./src/index.ts",
-      "import": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
     }
   },
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "files": [
-    "src/**/*.ts",
-    "!src/**/*.test.*",
-    "!src/**/*.spec.*",
-    "!src/**/vitest.config.*",
-    "!src/**/setupTest.*"
+    "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.26.0"
+    "@svadmin/core": "^0.32.0"
   },
   "devDependencies": {
     "typescript": "^5.7.0"
   },
+  "scripts": {
+    "build": "bun ../../scripts/build-node-package.ts"
+  },
   "peerDependenciesMeta": {
     "@svadmin/core": {
       "optional": true