@truenas/api-client 3.0.5 → 3.0.7

package/dist/index.cjs

@@ -2401,6 +2401,7 @@ var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
   AuthErrorCode2["OtpAuthFailed"] = "OTP_AUTH_FAILED";
   AuthErrorCode2["ApiKeyAuthFailed"] = "API_KEY_AUTH_FAILED";
   AuthErrorCode2["TokenAuthFailed"] = "TOKEN_AUTH_FAILED";
+  AuthErrorCode2["LoginSuperseded"] = "LOGIN_SUPERSEDED";
   AuthErrorCode2["FullAdminRequired"] = "FULL_ADMIN_REQUIRED";
   return AuthErrorCode2;
 })(AuthErrorCode || {});
@@ -2439,24 +2440,70 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     this.authenticating$ = new rxjs.BehaviorSubject(false);
     this.credentials = { username: "", password: "", key: "" };
     this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
+    /**
+     * Claimed by each login when it sends and checked when its answer lands: a
+     * difference means another login or a logout was issued in between, so this
+     * answer is stale and must not write session state. Responses on one socket
+     * are not ordered, which is why arrival is not enough to make an answer
+     * current.
+     *
+     * `logout()` bumps it without claiming one. It has no answer to guard —
+     * it settles its own state at the call — and bumping is what invalidates the
+     * logins already on the wire that a logout is meant to override.
+     */
+    this.authEpoch = 0;
+    /**
+     * Caller-issued logins still awaiting an answer, keyed by the epoch each
+     * claimed. The value is whether its frame has been written to a socket yet.
+     *
+     * The auto-relogin below defers while any entry exists. It is this class
+     * retrying a cached credential, not a request anyone made, so it must never
+     * outrank an explicit login — and it would: `TrueNasConnection.send` holds a
+     * frame through an outage rather than dropping it, so a login submitted while
+     * the socket is down is still pending when `opened` fires, and a relogin
+     * claiming the newer epoch has that login answered `LoginSuperseded` while the
+     * client authenticates as the previously cached account.
+     *
+     * Keyed rather than counted, because a count cannot say *which* login a
+     * removal belongs to: a login torn down by its caller would retire a slot
+     * belonging to a different login that is still waiting, and the retry would
+     * overtake it again. Identity also makes a double-subscribed login harmless.
+     */
+    this.liveCallerLogins = /* @__PURE__ */ new Map();
+    /** True only while the constructor's relogin is being constructed. */
+    this.reloginInProgress = false;
+    this.connection.opened.subscribe((isOpen) => {
+      if (!isOpen) return;
+      for (const epoch of this.liveCallerLogins.keys()) {
+        this.liveCallerLogins.set(epoch, true);
+      }
+    });
     this.connection.opened.pipe(
       rxjs.filter(
-        (isOpen) => !!(isOpen && this.credentials?.username && (this.credentials.password || this.credentials.key))
+        (isOpen) => !!(isOpen && this.credentials?.username && (this.credentials.password || this.credentials.key) && // An explicit login already on the wire outranks this retry.
+        this.liveCallerLogins.size === 0)
       ),
       rxjs.switchMap(() => {
-        if (this.credentials.password) {
-          return this.loginWithUserPass(
+        this.reloginInProgress = true;
+        let relogin;
+        try {
+          relogin = this.credentials.password ? this.loginWithUserPass(
             this.credentials.username,
             this.credentials.password
-          );
+          ) : this.loginWithApiKey({
+            username: this.credentials.username,
+            key: this.credentials.key
+          });
+        } finally {
+          this.reloginInProgress = false;
         }
-        return this.loginWithApiKey({
-          username: this.credentials.username,
-          key: this.credentials.key
-        });
+        return relogin.pipe(rxjs.catchError(() => rxjs.EMPTY));
       })
     ).subscribe();
     connection.closed.subscribe(() => {
+      for (const [epoch, flushed] of this.liveCallerLogins) {
+        if (flushed) this.liveCallerLogins.delete(epoch);
+      }
       this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
       this.authenticated$.next(false);
     });
@@ -2487,7 +2534,36 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     if (!this.version || this.version.year <= legacyCutoffYear) return void 0;
     return { login_options: { reconnect_token: true } };
   }
+  /**
+   * Throws when another login or a logout was issued after this one was sent,
+   * so a stale answer cannot be reported to its caller as a successful login.
+   */
+  assertNotSuperseded(sentDuring) {
+    if (this.authEpoch === sentDuring) return;
+    throw new AuthError(
+      "LOGIN_SUPERSEDED" /* LoginSuperseded */,
+      "Login was superseded by a later logout or login and was discarded."
+    );
+  }
+  /** Claim the next epoch for a login, and record it if a caller asked for it. */
+  beginLogin() {
+    const callerInitiated = !this.reloginInProgress;
+    const sentDuring = ++this.authEpoch;
+    if (callerInitiated) {
+      this.liveCallerLogins.set(sentDuring, this.connection.opened.value);
+    }
+    return { sentDuring, callerInitiated };
+  }
+  endLogin(sentDuring, callerInitiated, answered) {
+    const flushed = this.liveCallerLogins.get(sentDuring);
+    if (callerInitiated && (answered || flushed)) {
+      this.liveCallerLogins.delete(sentDuring);
+    }
+    this.authenticating$.next(false);
+  }
   loginWithUserPass(username, password) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
         mechanism: "PASSWORD_PLAIN" /* Password */,
@@ -2501,6 +2577,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      rxjs.tap(() => {
+        answered = true;
+      }),
       rxjs.map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2517,28 +2596,21 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       ),
       rxjs.tap((res) => {
         if (res.response_type === "SUCCESS" /* Success */) {
-          if (res.user_info?.privilege.roles.$set.includes("FULL_ADMIN" /* FullAdmin */)) {
-            this.credentials.username = username;
-            this.credentials.password = password;
-            this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
-            this.authenticated$.next(true);
-          } else {
-            this.logout();
-            this.authenticated$.next(false);
-            throw new AuthError(
-              "FULL_ADMIN_REQUIRED" /* FullAdminRequired */,
-              "User account must have full admin privileges"
-            );
-          }
+          this.assertNotSuperseded(sentDuring);
+          this.credentials = { username, password, key: "" };
+          this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
+          this.authenticated$.next(true);
         }
       }),
       rxjs.finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       rxjs.take(1)
     );
   }
   loginWithOtp(code) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
         mechanism: "OTP_TOKEN" /* Otp */,
@@ -2550,6 +2622,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      rxjs.tap(() => {
+        answered = true;
+      }),
       rxjs.map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2562,6 +2637,7 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       rxjs.tap((res) => {
         if (res?.response_type === "SUCCESS" /* Success */) {
+          this.assertNotSuperseded(sentDuring);
           this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
           this.authenticated$.next(true);
         }
@@ -2571,7 +2647,7 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         "TrueNAS authentication failed. Please verify your one-time passcode and try again."
       ),
       rxjs.finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       rxjs.take(1)
     );
@@ -2596,6 +2672,8 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
    * reason the socket dropped in the first place.
    */
   loginWithToken(token) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
         mechanism: "TOKEN_PLAIN" /* Token */,
@@ -2608,6 +2686,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      rxjs.tap(() => {
+        answered = true;
+      }),
       rxjs.map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2634,21 +2715,13 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       rxjs.tap((res) => {
         if (res.response_type === "SUCCESS" /* Success */) {
-          if (res.user_info?.privilege.roles.$set.includes("FULL_ADMIN" /* FullAdmin */)) {
-            this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
-            this.authenticated$.next(true);
-          } else {
-            this.logout();
-            this.authenticated$.next(false);
-            throw new AuthError(
-              "FULL_ADMIN_REQUIRED" /* FullAdminRequired */,
-              "User account must have full admin privileges"
-            );
-          }
+          this.assertNotSuperseded(sentDuring);
+          this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
+          this.authenticated$.next(true);
         }
       }),
       rxjs.finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       rxjs.take(1)
     );
@@ -2659,6 +2732,8 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
    * and replayed. The token exists for the credential that cannot be.
    */
   loginWithApiKey(credentials) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const { username, key } = credentials;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
@@ -2672,6 +2747,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      rxjs.tap(() => {
+        answered = true;
+      }),
       rxjs.map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2687,13 +2765,13 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         "TrueNAS authentication failed. Has the TrueNAS Connect API key been removed from your TrueNAS server?"
       ),
       rxjs.tap((res) => {
-        this.credentials.username = username;
-        this.credentials.key = key;
+        this.assertNotSuperseded(sentDuring);
+        this.credentials = { username, password: "", key };
         this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
         this.authenticated$.next(true);
       }),
       rxjs.finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       rxjs.take(1)
     );
@@ -2720,6 +2798,10 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     );
   }
   logout() {
+    this.credentials = { username: "", password: "", key: "" };
+    this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
+    this.authEpoch += 1;
+    this.authenticated$.next(false);
     const message = createJsonRpcMessage("auth.logout");
     this.connection.send(message);
     const messageId = message.id ?? "";
@@ -2731,10 +2813,6 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         }
         return msg.result;
       }),
-      rxjs.tap((success) => {
-        this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
-        this.authenticated$.next(!success);
-      }),
       rxjs.take(1)
     );
   }
@@ -2758,6 +2836,7 @@ var noopLogger = {
 };
 
 // src/utils/truenas-connection.utils.ts
+var policyViolationCloseCode = 1008;
 function isHttpStatusError(reason) {
   return ["404", "502", "503"].some((code) => reason.includes(code));
 }
@@ -2866,7 +2945,25 @@ var TrueNasConnection = class {
       rxjs.switchMap((enabled) => {
         if (enabled) {
           return this.connect().pipe(
-            rxjs.map((conn) => makeActiveConnection(conn.ws, conn.hostname))
+            rxjs.map((conn) => makeActiveConnection(conn.ws, conn.hostname)),
+            // A refusal becomes a value here rather than an error, so it never
+            // reaches the `retry` below and nothing reconnects on its own.
+            //
+            // Handled at this depth on purpose: letting it out completes the
+            // pipeline and unsubscribes `enabledChange$`, and `setEnabled` is the
+            // documented way an app asks for another attempt once the network
+            // changes. Not retrying is a statement about what this client does on
+            // its own; it is not a reason to refuse the caller asking again.
+            rxjs.catchError(
+              (err) => isTerminalClose(err) ? rxjs.of(
+                makeConnectionError(
+                  err.message,
+                  err.hostname,
+                  err.closeCode,
+                  err.closeReason
+                )
+              ) : rxjs.throwError(() => err)
+            )
           );
         }
         return rxjs.of(closedConnection);
@@ -2892,7 +2989,14 @@ var TrueNasConnection = class {
       rxjs.catchError((err) => {
         this.logger.error("All connections failed - retrying", { message: err?.message, hostname: err?.hostname });
         return rxjs.concat(
-          rxjs.of(makeConnectionError(err.message, err.hostname)),
+          rxjs.of(
+            makeConnectionError(
+              err.message,
+              err.hostname,
+              err.closeCode,
+              err.closeReason
+            )
+          ),
           // since this error will immediately get caught by `retry` there's no reason to build a real error.
           rxjs.throwError(() => null)
         );
@@ -3001,6 +3105,11 @@ var TrueNasConnection = class {
   /**
    * enables or disables the connection gate. the app calls this when its `SystemState`
    * changes (mapping `SystemState.Active -> true`, everything else -> `false`).
+   *
+   * This is also how a caller asks for another attempt after the appliance has
+   * refused the client — nothing reconnects on its own from there. The gate is
+   * `distinctUntilChanged`, so re-asserting `true` while it is already `true`
+   * does nothing: the round trip through `false` is what asks again.
    */
   setEnabled(enabled) {
     this.enabled$.next(enabled);
@@ -3058,7 +3167,9 @@ var TrueNasConnection = class {
               errorMessage = getWebSocketError(event.code);
             }
             this.connectionAttempts.next(this.connectionAttempts.value + 1);
-            subscriber.error(makeConnectionError(errorMessage, hostname));
+            subscriber.error(
+              makeConnectionError(errorMessage, hostname, event.code, reason)
+            );
           }
         }
       });
@@ -3108,12 +3219,15 @@ var makeActiveConnection = (ws, hostname) => ({
   hostname,
   state: "active"
 });
-var makeConnectionError = (message, hostname) => ({
+var makeConnectionError = (message, hostname, closeCode, closeReason) => ({
   name: "ConnectionError",
   message,
   hostname,
+  closeCode,
+  closeReason,
   state: "error"
 });
+var isTerminalClose = (err) => err?.closeCode === policyViolationCloseCode;
 var closedConnection = { state: "closed" };
 
 // src/client/truenas-api-client.ts
@@ -3925,6 +4039,12 @@ function errorMessageOrDefault(error, fallback) {
   return fallback;
 }
 
+// src/enums/user-role.enum.ts
+var UserRole = /* @__PURE__ */ ((UserRole2) => {
+  UserRole2["FullAdmin"] = "FULL_ADMIN";
+  return UserRole2;
+})(UserRole || {});
+
 exports.AppState = AppState;
 exports.AuthError = AuthError;
 exports.AuthErrorCode = AuthErrorCode;
@@ -3937,6 +4057,7 @@ exports.TrueNasApiClientV2510 = TrueNasApiClientV2510;
 exports.TrueNasApiClientV26 = TrueNasApiClientV26;
 exports.TrueNasApiClientV27 = TrueNasApiClientV27;
 exports.TrueNasAuthMechanism = TrueNasAuthMechanism;
+exports.UserRole = UserRole;
 exports.VersionCompatibility = VersionCompatibility;
 exports.VersionDiscovery = VersionDiscovery;
 exports.VersionDiscoveryError = VersionDiscoveryError;