@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/security/AuthSessionContext.js

@@ -6,7 +6,7 @@ import { getManualCallsHttpClient, } from '../../core/requests/wildo-http-client
 import { classifyRegistrationOutcome, RegistrationOutcome } from '../../core/security/registration-outcome.frontend.utils.js';
 import { isSpentOrganizationOnboardingSession, parkedOrganizationOnboardingSessionId } from '../../core/security/organization-onboarding.frontend.utils.js';
 import { forgetPendingMfaSession, rememberPendingMfaSession } from '../../core/security/pending-mfa-session-storage.frontend.utils.js';
-import { isAuthoritativeRefreshRejection, isRefreshDevLenient } from '../../core/requests/auth-refresh-resilience.frontend.js';
+import { isAuthoritativeRefreshRejection, isRefreshDevLenient, sessionEndReasonForRefusal } from '../../core/requests/auth-refresh-resilience.frontend.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { resolveComponentLabel } from '../../core/i18n/component-label-resolution.utils.js';
@@ -22,6 +22,14 @@ import { FrontendComponentType, MfaChallengeLabel, UserAuthLabel } from '@wildo-
 import { SessionEndReason, SessionEstablishment } from '../../core/events/events.frontend.schemas.js';
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('AuthSessionContext');
+/**
+ * The session ends sign-in explains (#2541): the ones the BACKEND decided. A person who signed out, here or in
+ * another tab, knows why; a session replaced by another person's sign-in leaves nobody to tell.
+ */
+const SESSION_REASONS_SIGN_IN_EXPLAINS = new Set([
+    SessionEndReason.SESSION_ENDED,
+    SessionEndReason.ACCOUNT_NOT_ACTIVE,
+]);
 logger.setDebugTypeLogging('AuthSessionContext', false);
 /**
  * The session states on which the server still admits second-factor work — a challenge or an enrollment
@@ -116,6 +124,21 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
     const sessionEndReasonRef = useRef(SessionEndReason.SESSION_ENDED);
     const getSessionEstablishment = useCallback(() => sessionEstablishmentRef.current, []);
     const getSessionEndReason = useCallback(() => sessionEndReasonRef.current, []);
+    /**
+     * Whether the session this tab held has already ended (#2541). A dying session is torn down by more than one
+     * caller: the refresh handler refuses it first, knowing exactly why (`ACCOUNT_NOT_ACTIVE`), and session restore or the
+     * forced-logout error path tear it down again a beat later, knowing only that a request failed. The FIRST end of a
+     * session records its reason; the later ones still tear down, but must not overwrite it with a vaguer one.
+     * Reset when a session is established.
+     */
+    const sessionEndRecordedRef = useRef(false);
+    const [endedSessionReason, setEndedSessionReasonState] = useState(null);
+    const endedSessionReasonRef = useRef(null);
+    const setEndedSessionReason = (reason) => {
+        endedSessionReasonRef.current = reason;
+        setEndedSessionReasonState(reason);
+    };
+    const getEndedSessionReason = useCallback(() => endedSessionReasonRef.current, []);
     /**
      * Auth-hardening Slice A Step 3 (2026-04-13) — `storeAuthTokens` now only
      * carries the access token. The refresh token travels via the
@@ -128,8 +151,14 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
     const storeAuthTokens = (accessToken, establishment) => {
         tokenStorage.storeTokens(accessToken, null);
         sessionEstablishmentRef.current = establishment;
+        markSessionLive();
         clearAnonymousSession();
     };
+    /** A session is held again: the next end is a new one, and sign-in has nothing left to explain (#2541). */
+    const markSessionLive = () => {
+        sessionEndRecordedRef.current = false;
+        setEndedSessionReason(null);
+    };
     /**
      * Store a ROTATED access token — a refresh, or a token another tab rotated or minted. Unlike
      * {@link storeAuthTokens} it says nothing about how the session was established (#1977): a rotation
@@ -138,6 +167,7 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
      */
     const storeRotatedAccessToken = (accessToken) => {
         tokenStorage.storeTokens(accessToken, null);
+        markSessionLive();
         clearAnonymousSession();
     };
     /**
@@ -349,8 +379,6 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 method: AuthMethod.PASSWORD,
                 factorLevel: AuthFactorLevel.FIRST,
                 password,
-                rememberMe: false,
-                requestedIntegrations: []
             };
             const resp = await getManualCallsHttpClient().authenticate(authRequest);
             // #1091: a sign-in by an account that still owes its organization resumes onboarding instead of minting.
@@ -840,8 +868,6 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 method,
                 factorLevel: AuthFactorLevel.SECOND,
                 token: code,
-                rememberMe: false,
-                requestedIntegrations: [],
             });
             // #1091: the second factor completed a sign-in whose account still owes its organization.
             const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);
@@ -1295,12 +1321,21 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
      * End this tab's session, recording WHY (#1977): `UserOrgsProvider` reads the reason when it announces
      * `USER_LOGOUT`, and a listener that counts sign-outs must not count a session the backend ended.
      * `logout` is the person's own sign-out; the refresh handler, session restore and the forced-logout
-     * error path end the session with {@link SessionEndReason.SESSION_ENDED}.
+     * error path end it with the reason the backend's refusal names (`sessionEndReasonForRefusal`): an account that
+     * can no longer sign in is {@link SessionEndReason.ACCOUNT_NOT_ACTIVE}, any other refusal
+     * {@link SessionEndReason.SESSION_ENDED} (#2541).
+     *
+     * The FIRST end of a session records its reason and, for a backend-ended one, the sign-in notice; later teardowns of
+     * the same dead session still tear down, but do not overwrite it.
      */
-    const endSession = useCallback((reason) => {
-        logDebug('Ending session', { reason });
+    const endSessionLocally = useCallback((reason, revokeOnBackend) => {
+        logDebug('Ending session', { reason, revokeOnBackend, alreadyEnded: sessionEndRecordedRef.current });
         identificationGenerationRef.current += 1;
-        sessionEndReasonRef.current = reason;
+        if (!sessionEndRecordedRef.current) {
+            sessionEndRecordedRef.current = true;
+            sessionEndReasonRef.current = reason;
+            setEndedSessionReason(SESSION_REASONS_SIGN_IN_EXPLAINS.has(reason) ? reason : null);
+        }
         sessionEstablishmentRef.current = SessionEstablishment.RESUMED;
         // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token now travels
         // via the `__wildo_refresh` `HttpOnly` cookie. JS can't read it (and
@@ -1311,12 +1346,16 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         // when the JS access token was lost (e.g., post tab crash). We keep
         // this unconditional now — there's no JS-visible "is there a session
         // to revoke?" signal anymore.
-        getManualCallsHttpClient()
-            .logoutFromBackend()
-            .catch((e) => {
-            logger.warn('Backend logout call failed (token revocation)', { error: e });
-        });
-        broadcastChannelRef.current?.postMessage({ type: 'LOGOUT' });
+        if (revokeOnBackend) {
+            getManualCallsHttpClient()
+                .logoutFromBackend()
+                .catch((e) => {
+                logger.warn('Backend logout call failed (token revocation)', { error: e });
+            });
+        }
+        // The reason travels with it (#2541 review): a session the backend refused is refused for every tab sharing its
+        // refresh cookie, so the other tabs' sign-in must say the same thing rather than "you signed out elsewhere".
+        broadcastChannelRef.current?.postMessage({ type: 'LOGOUT', reason: sessionEndReasonRef.current });
         disconnect();
         // Clear consumable token from HTTP client singletons (prevents stale header leakage)
         getManualCallsHttpClient().setConsumableToken(null);
@@ -1331,8 +1370,18 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         hasInitializedRef.current = false;
         logger.info('User logged out successfully');
     }, [disconnect, tokenStorage, setResourcesAuthToken, setResourcesConsumableToken]);
+    const endSession = useCallback((reason) => endSessionLocally(reason, true), [endSessionLocally]);
     /** The person signs out of this tab. */
     const logout = useCallback(() => endSession(SessionEndReason.SIGNED_OUT), [endSession]);
+    /**
+     * The person signs out everywhere (#2317). The backend fences every token of the account and clears
+     * this tab's refresh cookie, so the local teardown that follows skips the single-session logout call:
+     * there is nothing left for it to revoke.
+     */
+    const signOutEverywhere = useCallback(async () => {
+        await getManualCallsHttpClient().logoutAllFromBackend();
+        endSessionLocally(SessionEndReason.SIGNED_OUT, false);
+    }, [endSessionLocally]);
     /**
      * Single-use clear for the cross-frontend-handoff context.
      *
@@ -1483,7 +1532,8 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                         ? error.customMessageReference
                         : (error instanceof Error ? error.message : 'Unknown error'),
                 });
-                endSession(SessionEndReason.SESSION_ENDED);
+                // The refusal says why (#2541): an account that can no longer sign in is told so, not just signed out.
+                endSession(sessionEndReasonForRefusal(error));
             }
             else {
                 logger.warn('Auth token renewal failed but session is preserved (will retry on the next request)', {
@@ -1534,7 +1584,15 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             if (type === 'LOGOUT') {
                 logDebug('Received logout signal from another tab');
                 identificationGenerationRef.current += 1;
-                sessionEndReasonRef.current = SessionEndReason.SIGNED_OUT_IN_ANOTHER_TAB;
+                // First end wins here too: this tab may already have recorded why its own session ended. Otherwise the
+                // sender's reason decides — a backend refusal is this tab's refusal as well; anything else was the person.
+                if (!sessionEndRecordedRef.current) {
+                    const sentReason = event.data?.reason;
+                    const backendEnded = SESSION_REASONS_SIGN_IN_EXPLAINS.has(sentReason);
+                    sessionEndRecordedRef.current = true;
+                    sessionEndReasonRef.current = backendEnded ? sentReason : SessionEndReason.SIGNED_OUT_IN_ANOTHER_TAB;
+                    setEndedSessionReason(backendEnded ? sentReason : null);
+                }
                 sessionEstablishmentRef.current = SessionEstablishment.RESUMED;
                 disconnect();
                 tokenStorage.clear();
@@ -1590,9 +1648,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         getSessionState,
         isAuthenticated,
         logout,
+        signOutEverywhere,
         endSession,
         getSessionEstablishment,
         getSessionEndReason,
+        endedSessionReason,
+        getEndedSessionReason,
         // OAuth2 + cross-frontend-handoff (shared AUTH_CODE_EXCHANGE primitive)
         initiateOAuth2Login,
         handleAuthCodeExchange,
@@ -1625,9 +1686,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         auth,
         tokenStorage,
         logout,
+        signOutEverywhere,
         endSession,
         getSessionEstablishment,
         getSessionEndReason,
+        endedSessionReason,
+        getEndedSessionReason,
         initiateOAuth2Login,
         handleAuthCodeExchange,
         handleEmailVerification,