@webtypen/webframez-core 0.3.75 → 0.3.76

package/auth-client.js

@@ -28,17 +28,30 @@ exports.createAuthFetch = function createAuthFetch(options = {}, originalFetch =
             || ![401, 403].includes(response.status)) return response;
         const failure = await response.clone().json().catch(() => null);
         if (!["unauthorized", "invalid_csrf"].includes(failure?.code)) return response;
-        if (!refreshing) {
+        const performRefresh = () => {
             const refreshHeaders = new Headers();
             const csrf = csrfCookie(options.cookieName);
             if (csrf) refreshHeaders.set("X-CSRF-Token", csrf);
-            refreshing = originalFetch(`${base}/refresh`, { method: "POST", credentials: "same-origin", headers: refreshHeaders })
-                .then(result => result.ok, () => false).finally(() => { refreshing = undefined; });
+            return originalFetch(`${base}/refresh`, { method: "POST", credentials: "same-origin", headers: refreshHeaders });
+        };
+        const retry = () => {
+            const nextCsrf = csrfCookie(options.cookieName);
+            if (nextCsrf) headers.set("X-CSRF-Token", nextCsrf);
+            return originalFetch(retryInput, { ...init, headers });
+        };
+        if (typeof navigator !== "undefined" && navigator.locks) {
+            // Hold the shared tab lock through the retry so another refresh cannot invalidate it.
+            return navigator.locks.request(`webframez-auth:${base}`, async () => {
+                const renewed = await performRefresh().then(result => result.ok, () => false);
+                return renewed ? retry() : response;
+            });
+        }
+        if (!refreshing) {
+            refreshing = performRefresh().then(result => result.ok, () => false)
+                .finally(() => { refreshing = undefined; });
         }
         if (!await refreshing) return response;
-        const nextCsrf = csrfCookie(options.cookieName);
-        if (nextCsrf) headers.set("X-CSRF-Token", nextCsrf);
-        return originalFetch(retryInput, { ...init, headers });
+        return retry();
     };
 };
 

package/dist/Auth/SessionAuth.d.ts

@@ -65,6 +65,8 @@ export declare class SessionAuth {
     verifyCsrf(token: string, csrf: string, kind?: "access" | "refresh"): Promise<boolean>;
     /** One winner under concurrency. A previously consumed refresh token revokes its device session. */
     refresh(token: string): Promise<SessionTokenPair | null>;
+    /** Trusted server refresh-secret lookup; never expose as a public endpoint. */
+    inspectRefresh(token: string): Promise<AuthSession | null>;
     /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
     renewAccess(token: string): Promise<SessionTokenPair | null>;
     /** Browser login metadata; arbitrary request data and token hashes are never exposed. */

package/dist/Auth/SessionAuth.js

@@ -144,6 +144,15 @@ class SessionAuth {
             return this.pair(next, access, refresh);
         });
     }
+    /** Trusted server refresh-secret lookup; never expose as a public endpoint. */
+    inspectRefresh(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const id = tokenSessionId(token);
+            if (!id)
+                return null;
+            return this.allowed(yield (yield this.rows()).findOne(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter())));
+        });
+    }
     /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
     renewAccess(token) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -151,7 +160,7 @@ class SessionAuth {
             if (!id)
                 return null;
             const rows = yield this.rows();
-            const filter = Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter());
+            const filter = Object.assign(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter()), { accessExpiresAt: { $lte: Date.now() } });
             const row = yield rows.findOne(filter);
             if (!row || !(yield this.allowed(row)))
                 return null;

package/dist/Auth/WebAuth.js

@@ -96,7 +96,7 @@ class WebAuth {
                 return null;
             const pair = yield this.sessions.renewAccess(token);
             if (!pair)
-                return null;
+                return this.sessions.inspectRefresh(token);
             this.writePair(res, pair);
             const name = this.cookies.prefix + "access";
             const cookies = (0, AuthSecurity_1.authHeader)(req, "cookie").split(";").map(value => value.trim()).filter(value => value && !value.startsWith(`${name}=`));

package/docs/authentication.md

@@ -475,7 +475,9 @@ unsafe requests, revive expired sessions, or extend absolute expiry. Explicit
 POST refresh rotates both secrets and retains replay protection. Middleware uses
 this resumption automatically when a response is available. Browser `createAuthFetch`
 refreshes rejected authentication/CSRF requests once, then repeats the rejected
-request once; login failures and permission errors are never retried.
+request once; login failures and permission errors are never retried. Web Locks
+serialize refresh calls across tabs in browsers supporting that API; a per-window
+single-flight promise remains the fallback.
 
 Reset tokens have 256-bit random secrets; only a SHA-256 digest bound to the scope
 and current password is stored. Per-account request cooldown is an atomic conditional

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webtypen/webframez-core",
-    "version": "0.3.75",
+    "version": "0.3.76",
     "description": "The core package of the typescript based webframez (web-framework) by webtypen.de",
     "homepage": "https://webtypen.de/",
     "license": "MIT",