@tstdl/base 0.93.173 → 0.93.175

package/ai/genkit/tests/multi-region.test.js

@@ -6,7 +6,7 @@ import { CircuitBreakerProvider } from '../../../circuit-breaker/provider.js';
 import { Logger } from '../../../logger/logger.js';
 import { setupIntegrationTest } from '../../../testing/index.js';
 import { vertexAiMultiLocation } from '../multi-region.plugin.js';
-vi.mock('#/utils/array/index.js', async (importOriginal) => {
+vi.mock('../../../utils/array/index.js', async (importOriginal) => {
     const actual = await importOriginal();
     return {
         ...actual,

package/ai/genkit/tests/token-limit-fallback.test.js

@@ -7,7 +7,7 @@ import { Logger } from '../../../logger/logger.js';
 import { setupIntegrationTest } from '../../../testing/index.js';
 import { timeout } from '../../../utils/timing.js';
 import { vertexAiMultiLocation } from '../multi-region.plugin.js';
-vi.mock('#/utils/array/index.js', async (importOriginal) => {
+vi.mock('../../../utils/array/index.js', async (importOriginal) => {
     const actual = await importOriginal();
     return {
         ...actual,

package/api/server/middlewares/cors.middleware.js

@@ -14,6 +14,7 @@ export function corsMiddleware(options = {}) {
         const origin = request.headers.tryGetSingle('Origin');
         const allowCredentials = (await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowCredentials)) ?? endpointDefinition?.credentials;
         if (isDefined(origin)) {
+            let allowOriginValidationFailed = false;
             if (isDefined(cors.accessControlAllowOrigin) && !response.headers.has('Access-Control-Allow-Origin')) {
                 const allowedOrigin = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowOrigin);
                 if (isDefined(allowedOrigin)) {
@@ -26,9 +27,8 @@ export function corsMiddleware(options = {}) {
                             response.headers.append('Vary', 'Origin');
                         }
                     }
-                    else if (isOptions) {
-                        response.statusCode = 403;
-                        return;
+                    else {
+                        allowOriginValidationFailed = true;
                     }
                 }
             }
@@ -39,11 +39,14 @@ export function corsMiddleware(options = {}) {
                     response.headers.set('Access-Control-Allow-Origin', origin);
                     response.headers.append('Vary', 'Origin');
                 }
-                else if (isOptions) {
-                    response.statusCode = 403;
-                    return;
+                else {
+                    allowOriginValidationFailed = true;
                 }
             }
+            if (isOptions && allowOriginValidationFailed && !response.headers.has('Access-Control-Allow-Origin')) {
+                response.statusCode = 403;
+                return;
+            }
         }
         if (isOptions) {
             const customAllowMethods = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowMethods);

package/authentication/client/authentication.service.d.ts

@@ -26,7 +26,7 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
     private readonly logger;
     private readonly disposeSignal;
     private readonly forceRefreshRequested;
-    private readonly forceRefreshRequested$;
+    private readonly forceRefreshSubject;
     private clockOffset;
     private initialized;
     private refreshLoopPromise;

package/authentication/client/authentication.service.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Subject, filter, firstValueFrom, from, race, skip, takeUntil, timer } from 'rxjs';
+import { Subject, filter, firstValueFrom, from, race, takeUntil, timer } from 'rxjs';
 import { CancellationSignal } from '../../cancellation/token.js';
 import { BadRequestError } from '../../errors/bad-request.error.js';
 import { ForbiddenError } from '../../errors/forbidden.error.js';
@@ -72,7 +72,7 @@ let AuthenticationClientService = class AuthenticationClientService {
     logger = inject(Logger, 'AuthenticationService');
     disposeSignal = inject(CancellationSignal).fork();
     forceRefreshRequested = signal(false);
-    forceRefreshRequested$ = toObservable(this.forceRefreshRequested);
+    forceRefreshSubject = new Subject();
     clockOffset = 0;
     initialized = false;
     refreshLoopPromise;
@@ -267,6 +267,7 @@ let AuthenticationClientService = class AuthenticationClientService {
             this.setAdditionalData(data);
         }
         this.forceRefreshRequested.set(true);
+        this.forceRefreshSubject.next();
     }
     /**
      * Refresh the token.
@@ -404,7 +405,7 @@ let AuthenticationClientService = class AuthenticationClientService {
             timer(Math.max(10, delayMs)),
             from(this.disposeSignal),
             this.token$.pipe(filter((t) => t?.exp !== referenceExp)),
-            this.forceRefreshRequested$.pipe(filter(Boolean), skip(1)),
+            this.forceRefreshSubject,
         ]), { defaultValue: undefined });
         while (this.disposeSignal.isUnset) {
             const token = this.token();
@@ -420,6 +421,7 @@ let AuthenticationClientService = class AuthenticationClientService {
                 // 2. Handle token refresh
                 if (needsRefresh) {
                     const lockResult = await this.lock.tryUse(undefined, async () => {
+                        this.loadToken();
                         const currentToken = this.token();
                         if (isUndefined(currentToken)) {
                             return;
@@ -428,9 +430,9 @@ let AuthenticationClientService = class AuthenticationClientService {
                         const currentNow = this.estimatedServerTimestampSeconds();
                         const currentBuffer = calculateRefreshBufferSeconds(currentToken);
                         const stillNeedsRefresh = this.forceRefreshRequested() || (currentNow >= currentToken.exp - currentBuffer);
-                        this.forceRefreshRequested.set(false);
                         if (stillNeedsRefresh) {
                             await this.refresh();
+                            this.forceRefreshRequested.set(false);
                         }
                     });
                     // If lock is held by another instance/tab, wait briefly for it to finish (passive sync)
@@ -441,6 +443,18 @@ let AuthenticationClientService = class AuthenticationClientService {
                             this.forceRefreshRequested.set(false);
                         }
                     }
+                    // Protection against tight loops (e.g. if server clock is ahead and sync failed)
+                    const newToken = this.token();
+                    if (isDefined(newToken)) {
+                        const newNow = this.estimatedServerTimestampSeconds();
+                        const newBuffer = calculateRefreshBufferSeconds(newToken);
+                        const stillNeedsRefresh = this.forceRefreshRequested() || (newNow >= newToken.exp - newBuffer);
+                        if (stillNeedsRefresh) {
+                            this.logger.warn('Token still needs refresh after attempt. Waiting for minRefreshDelay to avoid tight loop.');
+                            await waitForNextAction(minRefreshDelay, newToken.exp);
+                        }
+                    }
+                    await waitForNextAction(100, newToken?.exp);
                     continue; // Re-evaluate the loop with the newly refreshed (or synced) token
                 }
                 // 3. Calculate delay and sleep until the next scheduled refresh window

package/authentication/server/authentication.service.d.ts

@@ -57,7 +57,7 @@ export declare class AuthenticationServiceOptions {
     /**
      * How long a refresh token is valid in milliseconds. Implies session time to live.
      *
-     * @default 1 hour
+     * @default 6 hours
      */
     refreshTokenTimeToLive?: number;
     /**

package/authentication/server/authentication.service.js

@@ -55,7 +55,7 @@ export class AuthenticationServiceOptions {
     /**
      * How long a refresh token is valid in milliseconds. Implies session time to live.
      *
-     * @default 1 hour
+     * @default 6 hours
      */
     refreshTokenTimeToLive;
     /**
@@ -126,7 +126,7 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
     };
     tokenVersion = this.#options.version ?? 1;
     tokenTimeToLive = this.#options.tokenTimeToLive ?? (5 * millisecondsPerMinute);
-    refreshTokenTimeToLive = this.#options.refreshTokenTimeToLive ?? (1 * millisecondsPerHour);
+    refreshTokenTimeToLive = this.#options.refreshTokenTimeToLive ?? (6 * millisecondsPerHour);
     rememberRefreshTokenTimeToLive = this.#options.rememberRefreshTokenTimeToLive ?? (30 * millisecondsPerDay);
     secretResetTokenTimeToLive = this.#options.secretResetTokenTimeToLive ?? (10 * millisecondsPerMinute);
     derivedTokenSigningSecret;

package/authentication/tests/authentication.client-service-refresh.test.js

@@ -130,4 +130,23 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         await service.refresh();
         expect(mockApiClient.timestamp).toHaveBeenCalled();
     });
+    test('Cross-tab Sync: should not refresh if another tab already did (simulated via localStorage update)', async () => {
+        const now = Math.floor(Date.now() / 1000);
+        const initialToken = { iat: now - 3600, exp: now + 5, jti: 'initial' }; // Expiring soon
+        globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(initialToken));
+        // 1. Mock lock behavior to simulate another tab refreshing while we wait for the lock
+        mockLock.tryUse.mockImplementation(async (_timeout, callback) => {
+            // Simulate another tab refreshing and updating localStorage
+            const newToken = { iat: now, exp: now + 3600, jti: 'refreshed-by-other-tab' };
+            globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(newToken));
+            const result = await callback({ lost: false });
+            return { success: true, result };
+        });
+        service = injector.resolve(AuthenticationClientService);
+        // Wait for loop to run
+        await timeout(100);
+        // Should NOT have called refresh because loadToken() inside the lock updated the token
+        expect(mockApiClient.refresh).not.toHaveBeenCalled();
+        expect(service.token()?.jti).toBe('refreshed-by-other-tab');
+    });
 });

package/authentication/tests/authentication.refresh-busy-loop.test.d.ts

@@ -0,0 +1 @@
+export {};

package/authentication/tests/authentication.refresh-busy-loop.test.js

@@ -0,0 +1,84 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+import { AuthenticationClientService } from '../../authentication/client/authentication.service.js';
+import { AUTHENTICATION_API_CLIENT } from '../../authentication/client/tokens.js';
+import { CancellationSignal, CancellationToken } from '../../cancellation/token.js';
+import { Injector } from '../../injector/index.js';
+import { Lock } from '../../lock/index.js';
+import { Logger } from '../../logger/index.js';
+import { MessageBus } from '../../message-bus/index.js';
+import { configureDefaultSignalsImplementation } from '../../signals/implementation/configure.js';
+import { timeout } from '../../utils/timing.js';
+import { Subject } from 'rxjs';
+describe('AuthenticationClientService Refresh Busy Loop Prevention', () => {
+    let injector;
+    let service;
+    let mockApiClient;
+    let mockLock;
+    let mockMessageBus;
+    let mockLogger;
+    let disposeToken;
+    beforeEach(() => {
+        const storage = new Map();
+        globalThis.localStorage = {
+            getItem: vi.fn((key) => storage.get(key) ?? null),
+            setItem: vi.fn((key, value) => storage.set(key, value)),
+            removeItem: vi.fn((key) => storage.delete(key)),
+            clear: vi.fn(() => storage.clear()),
+        };
+        configureDefaultSignalsImplementation();
+        injector = new Injector('Test');
+        mockApiClient = {
+            login: vi.fn(),
+            refresh: vi.fn(),
+            timestamp: vi.fn().mockResolvedValue(1000), // Fixed timestamp
+            endSession: vi.fn().mockResolvedValue(undefined),
+        };
+        mockLock = {
+            tryUse: vi.fn(async (_timeout, callback) => {
+                const result = await callback({ lost: false });
+                return { success: true, result };
+            }),
+            use: vi.fn(async (_timeout, callback) => {
+                return await callback({ lost: false });
+            }),
+        };
+        mockMessageBus = {
+            publishAndForget: vi.fn(),
+            messages$: new Subject(),
+            dispose: vi.fn(),
+        };
+        mockLogger = {
+            error: vi.fn(),
+            warn: vi.fn(),
+            info: vi.fn(),
+            debug: vi.fn(),
+        };
+        injector.register(AUTHENTICATION_API_CLIENT, { useValue: mockApiClient });
+        injector.register(Lock, { useValue: mockLock });
+        injector.register(MessageBus, { useValue: mockMessageBus });
+        injector.register(Logger, { useValue: mockLogger });
+        disposeToken = new CancellationToken();
+        injector.register(CancellationSignal, { useValue: disposeToken.signal });
+    });
+    afterEach(async () => {
+        disposeToken.set();
+        await injector.dispose();
+    });
+    test('should not busy loop when refresh fails to produce a valid token', async () => {
+        // 1. Mock a token that is ALWAYS expired
+        // Server time is 1000. Token expires at 500.
+        const expiredToken = { iat: 0, exp: 500, jti: 'expired', session: 's', tenant: 't', subject: 'sub' };
+        globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(expiredToken));
+        // refresh() will return the SAME expired token
+        mockApiClient.refresh.mockResolvedValue(expiredToken);
+        // 2. Start service
+        service = injector.resolve(AuthenticationClientService);
+        // 3. Wait a bit
+        // With 100ms mandatory yield + minRefreshDelay (1 min) protection, it should only try once or twice in 500ms
+        // WITHOUT protection, it would try thousands of times.
+        await timeout(500);
+        // It should have tried to refresh
+        expect(mockApiClient.refresh.mock.calls.length).toBeLessThan(5);
+        expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('Token still needs refresh after attempt'));
+    });
+});

package/document-management/tests/ai-config-integration.test.js

@@ -90,10 +90,10 @@ describe('DocumentManagementAiService Integration', () => {
         await runInInjectionContext(injector, async () => {
             await aiService.extractData(tenantId, document.id);
             const lastCall = mockGenerate.mock.calls[0][0];
-            const systemPrompt = lastCall.system;
-            const systemPromptText = systemPrompt.map((p) => p.text).join('\n');
-            expect(systemPromptText).toContain('Format the title of the document exactly as follows: INV-{{Date}}');
-            expect(systemPromptText).toContain('Focus on items.');
+            const userPrompt = lastCall.prompt;
+            const userPromptText = userPrompt.map((p) => p.text).join('\n');
+            expect(userPromptText).toContain('Format the title of the document exactly as follows: INV-{{Date}}');
+            expect(userPromptText).toContain('Focus on items.');
         });
     });
     test('classifyDocumentType should include granular instructions in prompt', async () => {

package/document-management/tests/document-validation-ai-overrides.test.js

@@ -6,6 +6,7 @@ import { object, string } from '../../schema/index.js';
 import { setupIntegrationTest } from '../../testing/index.js';
 import { isString } from '../../utils/type-guards.js';
 import { DocumentManagementConfiguration } from '../server/module.js';
+import { DocumentFileService } from '../server/services/document-file.service.js';
 import { DocumentManagementAiProviderService, DocumentManagementAncillaryService } from '../server/services/index.js';
 import { AiValidationExecutor } from '../server/validators/ai-validation-executor.js';
 import { TestDocumentManagementAncillaryService } from './helper.js';
@@ -41,6 +42,7 @@ describe('AiValidationExecutor Overrides', () => {
         injector.register(DocumentManagementAiProviderService, { useValue: mockAiProvider });
         injector.register(DocumentManagementAncillaryService, { useToken: TestDocumentManagementAncillaryService });
         injector.register(DocumentManagementConfiguration, { useValue: { fileObjectStorageModule: 'docs', fileUploadObjectStorageModule: 'uploads', filePreviewObjectStorageModule: 'previews' } });
+        injector.register(DocumentFileService, { useValue: { getContent: vi.fn().mockResolvedValue(new Uint8Array([1, 2, 3])) } });
     });
     afterAll(async () => {
         await injector?.dispose();
@@ -66,6 +68,7 @@ describe('AiValidationExecutor Overrides', () => {
             const context = {
                 execution: { tenantId },
                 definition: { identifier: 'test-validation' },
+                document: { id: 'test-doc', mimeType: 'application/pdf' },
             };
             await executor.publicExecute(context);
             const call = generateSpy.mock.calls[0][0];

package/http/server/http-server-response.d.ts

@@ -23,9 +23,9 @@ export type HttpServerResponseOptions = {
 };
 export declare class HttpServerResponse {
     #private;
+    readonly headers: HttpHeaders;
     statusCode: number | undefined;
     statusMessage: string | undefined;
-    headers: HttpHeaders;
     get body(): HttpServerResponseBody | undefined;
     set body(value: HttpServerResponseBody | undefined);
     get bodyType(): HttpServerResponseBodyType;

package/http/server/http-server-response.js

@@ -5,9 +5,9 @@ import { HttpHeaders } from '../http-headers.js';
 export class HttpServerResponse {
     #body;
     #bodyType;
+    headers = new HttpHeaders();
     statusCode;
     statusMessage;
-    headers;
     get body() {
         return this.#body;
     }
@@ -35,10 +35,18 @@ export class HttpServerResponse {
         });
     }
     update(options) {
-        this.statusCode = options.statusCode;
-        this.statusMessage = options.statusMessage;
-        this.headers = new HttpHeaders(options.headers);
-        this.body = options.body;
+        if (isDefined(options.statusCode)) {
+            this.statusCode = options.statusCode;
+        }
+        if (isDefined(options.statusMessage)) {
+            this.statusMessage = options.statusMessage;
+        }
+        if (isDefined(options.headers)) {
+            this.headers.setMany(options.headers);
+        }
+        if (isDefined(options.body)) {
+            this.body = options.body;
+        }
         if (isDefined(options.cookies)) {
             for (const [name, cookie] of objectEntries(options.cookies)) {
                 this.headers.append('Set-Cookie', formatSetCookie(name, cookie.value, cookie));

package/logger/tests/pretty-print.test.js

@@ -1,11 +1,11 @@
 import { describe, expect, it, vi } from 'vitest';
 // Mock supports before importing PrettyPrintLogFormatter
-vi.mock('#/supports.js', () => ({
+vi.mock('../../supports.js', () => ({
     supportsColoredStdout: true,
     supportsColoredStderr: true,
 }));
-import { LogLevel } from '../level.js';
 import { PrettyPrintLogFormatter } from '../formatters/pretty-print.js';
+import { LogLevel } from '../level.js';
 describe('PrettyPrintLogFormatter', () => {
     const formatter = new PrettyPrintLogFormatter();
     it('should format a log entry with an error and no context', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tstdl/base",
-  "version": "0.93.173",
+  "version": "0.93.175",
   "author": "Patrick Hein",
   "publishConfig": {
     "access": "public"
@@ -203,7 +203,6 @@
     "typedoc-plugin-missing-exports": "4.1",
     "typescript": "5.9",
     "typescript-eslint": "8.57",
-    "vite-tsconfig-paths": "6.1",
     "vitest": "4.1"
   }
 }