@vibexnpm/talkx 7.2.0 → 8.0.0

package/src/core/ConnectionManager.js

@@ -3,6 +3,7 @@
  * WebSocket/STOMP 연결 관리 (Chat, WebRTC 공유)
  */
 
+import { isTerminalAuthError } from '../auth/AuthSession.js';
 import EventEmitter from '../utils/EventEmitter.js';
 import Logger from '../utils/Logger.js';
 import { ConnectionState, ErrorTypes, WebSocketPaths, DefaultConfig, LogLevel } from '../constants.js';
@@ -289,6 +290,36 @@ class ConnectionManager extends EventEmitter {
         const wsUrl = this._getWebSocketUrl();
 
         const config = {
+            beforeConnect: async (client) => {
+                if (!this.getAccessToken) return;
+                let attempt = 0;
+                while (!this._intentionalDisconnect && (!client || client.active)) {
+                    try {
+                        const token = await this.getAccessToken({ forceRefresh: this._authRejected === true });
+                        if (this._intentionalDisconnect || (client && !client.active)) return;
+                        this.updateToken(token);
+                        this._authRejected = false;
+                        return;
+                    } catch (error) {
+                        this.emit('error', { type: ErrorTypes.CONNECTION_FAILED, message: error.message, error });
+                        if (isTerminalAuthError(error)) {
+                            this._setState(ConnectionState.ERROR);
+                            this._connectReject?.(error);
+                            this._connectResolve = this._connectReject = null;
+                            await (client || this.stompClient)?.deactivate();
+                            return;
+                        }
+                        // beforeConnect의 예외에는 STOMP 소켓 종료 백오프가 적용되지 않는다.
+                        const wait = Math.min(30000, 1000 * 2 ** Math.min(attempt++, 5)) * (0.8 + Math.random() * 0.4);
+                        await new Promise(resolve => {
+                            this._cancelAuthRetry = () => { clearTimeout(this._authRetryTimer); resolve(); };
+                            this._authRetryTimer = setTimeout(resolve, wait);
+                            this._authRetryTimer.unref?.();
+                        });
+                        this._cancelAuthRetry = null;
+                    }
+                }
+            },
             connectHeaders: {
                 'Authorization': this.jwtToken.startsWith('Bearer ')
                     ? this.jwtToken
@@ -369,6 +400,7 @@ class ConnectionManager extends EventEmitter {
      * @private
      */
     _onConnect(frame) {
+        this._authenticatedToken = this.jwtToken;
         // 재연결 여부 판정은 카운터 리셋 전에 — 갭 복구(S4)가 이 신호로 동기화를 건다.
         const attempts = this.reconnectAttempts;
         const isReconnect = attempts > 0 || this._hasConnectedBefore === true;
@@ -413,6 +445,10 @@ class ConnectionManager extends EventEmitter {
      * @private
      */
     _onStompError(frame) {
+        try {
+            const payload = JSON.parse(frame.body || frame.headers?.message || '{}');
+            this._authRejected = ['ACCESS_UNAUTHORIZED', 'SESSION_REVOKED', 'TOKEN_INVALID'].includes(payload.code);
+        } catch { /* Non-authentication STOMP errors keep the normal reconnect policy. */ }
         this.logger.error('STOMP error:', frame);
         this._setState(ConnectionState.ERROR);
 
@@ -439,6 +475,8 @@ class ConnectionManager extends EventEmitter {
      * @private
      */
     _onWebSocketClose(event) {
+        if (this.stompClient && event?.code === 1012) this.stompClient.reconnectDelay = this.reconnectDelay * (0.8 + Math.random() * 0.4);
+        if (event?.code === 4001) this._authRejected = true;
         this.logger.warn('WebSocket closed:', event);
 
         // forceReconnect 의 의도적 teardown 이면 재연결 시도로 집계하지 않는다 —
@@ -657,6 +695,10 @@ class ConnectionManager extends EventEmitter {
     async disconnect() {
         // 명시적 해제 — 포그라운드 복귀가 이걸 되살리면 안 된다.
         this._intentionalDisconnect = true;
+        this._connectRequested = false;
+        this._cancelAuthRetry?.();
+        this._connectReject?.(Object.assign(new Error('Connection cancelled'), { code: 'AUTH_OPERATION_CANCELLED' }));
+        this._connectResolve = this._connectReject = null;
         this._drainPendingSubscriptions('Disconnected before subscription completed');
 
         if (this.stompClient) {

package/src/push/PushManager.js

@@ -537,6 +537,7 @@ class PushManager {
     async _registerTokenToServer(token) {
         try {
             const deviceId = await this._getDeviceId();
+            this.apiClient?.authProvider?.setDeviceId(deviceId);
             await this.apiClient.post('/api/v1/push/devices', {
                 deviceToken: token,
                 deviceType: 'WEB',
@@ -623,6 +624,7 @@ class PushManager {
             }
 
             this._deviceIdCache = deviceId;
+            this.apiClient?.authProvider?.setDeviceId(deviceId);
             return deviceId;
         } catch (error) {
             // IndexedDB 장애 (open / read / transaction throw 등) 시 fallback.

package/src/talkflow/session.js

@@ -27,6 +27,10 @@ export function initializeSubClients(client) {
         resumeOnVisibility: client.options.resumeOnVisibility,
         logLevel: client.options.logLevel
     });
+    client.connectionManager.getAccessToken = async ({ forceRefresh = false } = {}) => {
+        if (!client.authSession) return client.options.jwtToken;
+        return client.authSession.getAccessToken({ forceRefresh, rejectedToken: client.connectionManager?.jwtToken });
+    };
 
     client._chat = new ChatClient({
         connectionManager: client.connectionManager,
@@ -60,6 +64,14 @@ export function applySessionMethods(TalkFlowClient) {
             await this.setToken(jwt);
         }
 
+        if (this.authSession) {
+            await this._authReady;
+            this._authConnectionRequested = true;
+            const token = await this.authSession.getAccessToken();
+            await this.setToken(token);
+            this.authSession.schedule();
+        }
+
         if (!this.options.jwtToken) {
             throw new Error(
                 'JWT token is required. Sign in with TalkFlowClient.loginUser({ serverUrl, ' +
@@ -68,7 +80,7 @@ export function applySessionMethods(TalkFlowClient) {
             );
         }
 
-        if (isJWTExpired(this.options.jwtToken)) {
+        if (!this.authSession && isJWTExpired(this.options.jwtToken)) {
             throw new Error('JWT token has expired. Please update the token before connecting.');
         }
 
@@ -98,6 +110,8 @@ export function applySessionMethods(TalkFlowClient) {
     };
 
     TalkFlowClient.prototype.disconnect = async function disconnect() {
+        this._authConnectionRequested = false;
+        this.authSession?.schedule();
         if (!this.connectionManager) {
             return;
         }
@@ -120,6 +134,7 @@ export function applySessionMethods(TalkFlowClient) {
     };
 
     TalkFlowClient.prototype.logout = async function logout() {
+        if (this.authSession) return this.authSession.logout();
         try {
             await this.apiClient.post('/v1/auth/signout');
             this.logger.info('Logged out from server');
@@ -339,6 +354,8 @@ export function applySessionMethods(TalkFlowClient) {
 
         if (needReinitialize && this.connectionManager) {
             await this.disconnect();
+            this._chat?.destroy();
+            this._webrtc?.destroy();
             // destroy() 로 버려야 lifecycle listener(visibilitychange/pageshow/online)가 해제된다.
             // disconnect() 만 하고 참조를 끊으면 죽은 매니저가 window 에 매달린 채 남아,
             // 사용자 전환이 잦은 앱에서 복귀 이벤트마다 유령 매니저가 함께 깨어난다.
@@ -346,6 +363,7 @@ export function applySessionMethods(TalkFlowClient) {
             if (this.pushManager) {
                 this.pushManager.reset();
                 this._pushEnablePromise = null;
+                this._pushManager = null;
             }
             this.connectionManager = null;
             this._chat = null;
@@ -359,6 +377,7 @@ export function applySessionMethods(TalkFlowClient) {
         }
 
         this.logger.info('JWT token set', { userId });
+        this.authSession?.replaceAccessToken(token);
         this.emit('tokenSet', { userId });
     };
 

package/src/utils/ApiClient.js

@@ -67,6 +67,26 @@ class ApiClient {
      * @returns {Promise<Object>}
      */
     async request(method, path, options = {}) {
+        if (!this.authProvider || options.skipAuth) return this._request(method, path, options);
+        this.jwtToken = await this.authProvider.getAccessToken();
+        const sentToken = this.jwtToken;
+        const generation = this.authProvider.generation;
+        try { return await this._request(method, path, options); }
+        catch (error) {
+            if (error.status === 401 && ['ACCESS_UNAUTHORIZED', 'TOKEN_INVALID'].includes(error.response?.code)) {
+                if (generation !== this.authProvider.generation) throw error;
+                this.jwtToken = await this.authProvider.getAccessToken({ forceRefresh: true, rejectedToken: sentToken });
+                const retryToken = this.jwtToken;
+                const retryGeneration = this.authProvider.generation;
+                try { return await this._request(method, path, options); }
+                catch (retryError) { await this.authProvider.authenticationFailed(retryError, { rejectedToken: retryToken, generation: retryGeneration }); throw retryError; }
+            }
+            await this.authProvider.authenticationFailed(error, { rejectedToken: sentToken, generation });
+            throw error;
+        }
+    }
+
+    async _request(method, path, options = {}) {
         const { body, params, headers } = options;
 
         // URL 빌드
@@ -90,11 +110,12 @@ class ApiClient {
 
         let response;
         try {
-            this.logger.debug(`${method} ${url}`, body ? { body } : '');
+            this.logger.debug(`${method} ${url}`);
 
             response = await fetch(url, {
                 method,
-                headers: headers ? { ...this._getHeaders(), ...headers } : this._getHeaders(),
+                headers: { ...this._getHeaders(), ...headers },
+                credentials: this.authProvider ? 'omit' : 'same-origin',
                 body: body ? JSON.stringify(body) : undefined,
                 signal: controller.signal
             });
@@ -133,7 +154,7 @@ class ApiClient {
             throw error;
         }
 
-        this.logger.debug(`Response ${response.status}:`, data);
+        this.logger.debug(`Response ${response.status}`);
         return data;
     }
 
@@ -207,7 +228,27 @@ class ApiClient {
      * @param {number} [options.timeout=600000] - 타임아웃 (ms). 기본 10분.
      * @returns {Promise<Object>} 서버 응답 JSON (SuccessResponse 래퍼 포함)
      */
-    upload(path, file, options = {}) {
+    async upload(path, file, options = {}) {
+        if (!this.authProvider) return this._upload(path, file, options);
+        this.jwtToken = await this.authProvider.getAccessToken();
+        const sentToken = this.jwtToken;
+        const generation = this.authProvider.generation;
+        try { return await this._upload(path, file, options); }
+        catch (error) {
+            if (error.status === 401 && ['ACCESS_UNAUTHORIZED', 'TOKEN_INVALID'].includes(error.response?.code)) {
+                if (generation !== this.authProvider.generation) throw error;
+                this.jwtToken = await this.authProvider.getAccessToken({ forceRefresh: true, rejectedToken: sentToken });
+                const retryToken = this.jwtToken;
+                const retryGeneration = this.authProvider.generation;
+                try { return await this._upload(path, file, options); }
+                catch (retryError) { await this.authProvider.authenticationFailed(retryError, { rejectedToken: retryToken, generation: retryGeneration }); throw retryError; }
+            }
+            await this.authProvider.authenticationFailed(error, { rejectedToken: sentToken, generation });
+            throw error;
+        }
+    }
+
+    _upload(path, file, options = {}) {
         const {
             fieldName = 'file',
             onProgress,

package/src/utils/jwtUtils.js

@@ -45,7 +45,7 @@ function base64UrlDecode(str) {
  * @throws {Error}
  */
 export function validateAndParseJWT(jwtToken, options = {}) {
-    const { bufferSeconds = 30, validateExpiry = true } = options;
+    const { bufferSeconds = 30, validateExpiry = true, validateIssuedAt = false } = options;
 
     if (!jwtToken || typeof jwtToken !== 'string') {
         const error = new Error('JWT token is required');
@@ -89,7 +89,7 @@ export function validateAndParseJWT(jwtToken, options = {}) {
         }
     }
 
-    if (payload.iat) {
+    if (validateIssuedAt && payload.iat) {
         const issuedAt = payload.iat * 1000;
         const clockSkew = 60 * 1000;
 

package/types/__typetests__/authSession.types.ts

@@ -0,0 +1,8 @@
+import TalkFlowClient, { AuthState, LoginResult } from '../index';
+const client = new TalkFlowClient({ serverUrl: 'https://api.example.com', sessionMode: 'refresh' });
+const restored: Promise<LoginResult | null> = client.restoreSession();
+const state: AuthState = client.getAuthState();
+const signedIn: boolean = client.isLoggedIn();
+const access: Promise<string> = client.getAccessToken({ forceRefresh: true, rejectedToken: 'old' });
+client.on('authStateChanged', ({ state }) => { const typed: AuthState = state; void typed; });
+void [restored, state, signedIn, access];

package/types/index.d.ts

@@ -1036,8 +1036,14 @@ export interface LoginMember {
  * 회사 선택 단계가 없다 — 로그인 키가 전역 유일이라 이메일 하나로 회원과 회사가 함께 정해진다.
  */
 export interface LoginResult {
+    /** SDK가 저장·회전하는 갱신 자격. 직접 API를 쓰는 경우에만 응답에서 사용한다. */
+    refreshToken?: string;
+    /** 서버 현재 시각 및 refresh 만료 시각, Unix epoch 밀리초. */
+    serverTime?: number;
+    refreshExpiresAt?: number;
     accessToken: string;
     tokenType: string;
+    /** Access 만료 시각, Unix epoch 초(남은 시간 아님). */
     expiresIn?: number;
     projectId: string;
     /** 회사의 활성 ck- 키. SDK 초기화의 `apiKey` 로 그대로 넣는다. */
@@ -1464,11 +1470,16 @@ export interface AssistantProgressSnapshot extends AssistantRoomProgressEvent {
 // Options — constructor & method
 // ============================================================================
 
+export type AuthState = 'checking' | 'authenticated' | 'unauthenticated' | 'unavailable';
+export interface AccessTokenOptions { forceRefresh?: boolean; rejectedToken?: string; }
+
 export interface TalkFlowClientOptions {
     /** Client API 키 (브라우저 노출 안전). */
-    apiKey: string;
+    apiKey?: string;
     /** 프로젝트 ID. */
-    projectId: string;
+    projectId?: string;
+    /** refresh: 키 없이 생성 후 restoreSession/loginUser 가능. 기존 JWT만 쓰면 legacy. */
+    sessionMode?: 'refresh' | 'legacy';
     /** JWT 토큰 — 고객사 backend 에서 발급 받아 전달. */
     jwtToken?: string;
     /** 환경. 기본 'production'. */
@@ -1867,6 +1878,8 @@ export interface TalkFlowClientEvents {
     connectionError: unknown;
     tokenSet: { userId: string };
     loggedOut: void;
+    authStateChanged: { state: AuthState; previous: AuthState; error?: unknown };
+    authError: unknown;
 
     // Chat (re-emit from ChatClient with prefixed names)
     chatMessage: ChatMessageReceivedPayload;
@@ -2432,6 +2445,18 @@ export default class TalkFlowClient implements SdkEventEmitter<TalkFlowClientEve
     /** 회원 로그인 (인스턴스) — 재로그인·계정 전환용. 성공 시 토큰을 자동 설정한다. */
     loginUser(credentials: { email: string; password: string }): Promise<LoginResult>;
 
+    /** localStorage의 refresh로 복구. 세션이 없으면 null, 네트워크/서버 장애는 reject. */
+    static restoreSession(options: { serverUrl: string }): Promise<LoginResult | null>;
+    restoreSession(): Promise<LoginResult | null>;
+    /** 캐시된 UI 상태. 호출 자체는 통신하지 않으며 서버 권한 판정은 요청 시 수행된다. */
+    getAuthState(): AuthState;
+    isLoggedIn(): boolean;
+    /** 유효한 메모리 토큰 반환. 필요할 때만 갱신하며 동시 요청은 하나로 합친다. */
+    getAccessToken(options?: AccessTokenOptions): Promise<string>;
+    /** 관리/캘린더 등 SDK 밖 호출용. 토큰 준비와 인증 오류 1회 재시도를 공통 적용한다. */
+    request<T = unknown>(method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', path: string,
+        options?: { body?: unknown; params?: Record<string, unknown>; headers?: Record<string, string> }): Promise<T>;
+
     /** 내 정보 조회. */
     getMyProfile(): Promise<MyProfile>;
 
@@ -2448,7 +2473,7 @@ export default class TalkFlowClient implements SdkEventEmitter<TalkFlowClientEve
         timeZone?: string;
     }): Promise<MyProfile>;
 
-    /** 비밀번호 변경 — 현재 비밀번호 재확인. 토큰은 그대로 유효해 재로그인이 필요 없다. */
+    /** 비밀번호 변경 — 기존 세션을 모두 폐기하고 이 브라우저에 새 세션을 자동 채택한다. */
     changeMyPassword(params: { currentPassword: string; newPassword: string }): Promise<unknown>;
 
     // Connection lifecycle