@witnium-tech/witniumchain 0.12.0 → 0.12.1

package/dist/index.d.mts

@@ -12050,6 +12050,7 @@ declare class WitniumchainClient {
     private refreshInFlight;
     private accessTokenFromSession;
     private sessionExchangeInFlight;
+    private credentialGeneration;
     /** Subscriptions / billing helpers. See {@link Subscriptions}. */
     readonly subscriptions: Subscriptions;
     /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -12161,8 +12162,9 @@ declare class WitniumchainClient {
     enrollTotp(): Promise<TotpEnrollResponse>;
     /**
      * Confirming bumps the user's security epoch server-side, which ends every
-     * session-minted access token. A cached one is dropped so the next bearer
-     * call mints a fresh token.
+     * session-minted access token and OAuth artifact of the user. Cached and
+     * in-flight tokens are dropped so the next bearer call mints a fresh one
+     * from the (surviving) session.
      */
     confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
     /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
@@ -12280,6 +12282,12 @@ declare class WitniumchainClient {
      * valid session.
      */
     exchangeSessionForToken(): Promise<OAuthTokenSnapshot>;
+    private assertCredentialGeneration;
+    /**
+     * Forget every cached credential and orphan in-flight mints/refreshes, so
+     * none of them can store a token afterwards.
+     */
+    private invalidateCredentials;
     /**
      * Best-effort transparent mint for the `BearerJWT` path: if no access token
      * is cached, try the session exchange (single-flight). Swallows failure so

package/dist/index.d.ts

@@ -12050,6 +12050,7 @@ declare class WitniumchainClient {
     private refreshInFlight;
     private accessTokenFromSession;
     private sessionExchangeInFlight;
+    private credentialGeneration;
     /** Subscriptions / billing helpers. See {@link Subscriptions}. */
     readonly subscriptions: Subscriptions;
     /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -12161,8 +12162,9 @@ declare class WitniumchainClient {
     enrollTotp(): Promise<TotpEnrollResponse>;
     /**
      * Confirming bumps the user's security epoch server-side, which ends every
-     * session-minted access token. A cached one is dropped so the next bearer
-     * call mints a fresh token.
+     * session-minted access token and OAuth artifact of the user. Cached and
+     * in-flight tokens are dropped so the next bearer call mints a fresh one
+     * from the (surviving) session.
      */
     confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
     /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
@@ -12280,6 +12282,12 @@ declare class WitniumchainClient {
      * valid session.
      */
     exchangeSessionForToken(): Promise<OAuthTokenSnapshot>;
+    private assertCredentialGeneration;
+    /**
+     * Forget every cached credential and orphan in-flight mints/refreshes, so
+     * none of them can store a token afterwards.
+     */
+    private invalidateCredentials;
     /**
      * Best-effort transparent mint for the `BearerJWT` path: if no access token
      * is cached, try the session exchange (single-flight). Swallows failure so

package/dist/index.js

@@ -121,6 +121,11 @@ var WitniumchainClient = class {
   // first BearerJWT call (and any concurrent fan-out) awaits one in-flight
   // mint rather than minting N tokens.
   sessionExchangeInFlight;
+  // Bumped whenever the cached credentials stop being valid (sign-out, the
+  // TOTP-confirm epoch bump). A mint or refresh that started under an older
+  // generation must not store its result: it could be a previous user's
+  // token, or one the server has already ended.
+  credentialGeneration = 0;
   /** Subscriptions / billing helpers. See {@link Subscriptions}. */
   subscriptions;
   /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -502,18 +507,16 @@ var WitniumchainClient = class {
   }
   /**
    * Confirming bumps the user's security epoch server-side, which ends every
-   * session-minted access token. A cached one is dropped so the next bearer
-   * call mints a fresh token.
+   * session-minted access token and OAuth artifact of the user. Cached and
+   * in-flight tokens are dropped so the next bearer call mints a fresh one
+   * from the (surviving) session.
    */
   async confirmTotp(body) {
     const res = await this.req("POST", "/v1/account/mfa/totp/confirm", {
       auth: "SessionCookie",
       body
     });
-    if (this.accessTokenFromSession) {
-      this.accessToken = void 0;
-      this.accessTokenFromSession = false;
-    }
+    this.invalidateCredentials();
     return res;
   }
   /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
@@ -791,14 +794,16 @@ var WitniumchainClient = class {
    */
   async refreshAccessToken() {
     if (this.refreshInFlight) return this.refreshInFlight;
-    this.refreshInFlight = (async () => {
+    let flight = void 0;
+    flight = (async () => {
       try {
         return await this.refreshAccessTokenInternal();
       } finally {
-        this.refreshInFlight = void 0;
+        if (this.refreshInFlight === flight) this.refreshInFlight = void 0;
       }
     })();
-    return this.refreshInFlight;
+    this.refreshInFlight = flight;
+    return flight;
   }
   /**
    * Exchange the logged-in session (the `wac_session` cookie) for a short-lived
@@ -823,9 +828,12 @@ var WitniumchainClient = class {
    */
   async exchangeSessionForToken() {
     if (this.sessionExchangeInFlight) return this.sessionExchangeInFlight;
-    this.sessionExchangeInFlight = (async () => {
+    const generation = this.credentialGeneration;
+    let flight = void 0;
+    flight = (async () => {
       try {
         const res = await this.req("POST", "/v1/auth/access-token", { auth: "SessionCookie" });
+        this.assertCredentialGeneration(generation);
         this.accessToken = res.accessToken;
         this.accessTokenFromSession = true;
         this.refreshToken = void 0;
@@ -835,10 +843,32 @@ var WitniumchainClient = class {
           expiresAt: Math.floor(new Date(res.expiresAt).getTime() / 1e3)
         };
       } finally {
-        this.sessionExchangeInFlight = void 0;
+        if (this.sessionExchangeInFlight === flight) this.sessionExchangeInFlight = void 0;
       }
     })();
-    return this.sessionExchangeInFlight;
+    this.sessionExchangeInFlight = flight;
+    return flight;
+  }
+  assertCredentialGeneration(generation) {
+    if (generation !== this.credentialGeneration) {
+      throw new WitniumchainApiError({
+        status: 0,
+        message: "WitniumchainClient: the session changed (sign-out or MFA confirmation) while a token request was in flight; its token was discarded."
+      });
+    }
+  }
+  /**
+   * Forget every cached credential and orphan in-flight mints/refreshes, so
+   * none of them can store a token afterwards.
+   */
+  invalidateCredentials() {
+    this.credentialGeneration++;
+    this.accessToken = void 0;
+    this.accessTokenFromSession = false;
+    this.refreshToken = void 0;
+    this.hasRefreshCookie = false;
+    this.sessionExchangeInFlight = void 0;
+    this.refreshInFlight = void 0;
   }
   /**
    * Best-effort transparent mint for the `BearerJWT` path: if no access token
@@ -850,7 +880,8 @@ var WitniumchainClient = class {
     if (this.accessToken) return;
     try {
       await this.exchangeSessionForToken();
-    } catch {
+    } catch (err) {
+      if (!(err instanceof WitniumchainApiError && err.status === 401)) throw err;
     }
   }
   /**
@@ -891,10 +922,7 @@ var WitniumchainClient = class {
    * dropped — which it is, here.
    */
   signOut() {
-    this.accessToken = void 0;
-    this.accessTokenFromSession = false;
-    this.refreshToken = void 0;
-    this.hasRefreshCookie = false;
+    this.invalidateCredentials();
     this.pendingLogins.clear();
   }
   // ────────────────────────────────────────────────────────────────────────
@@ -1014,6 +1042,7 @@ var WitniumchainClient = class {
         message: "WitniumchainClient: no refresh credential available. Call `completeOAuthLogin` first \u2014 the server delivers the refresh token either in the response body (Node) or as an HttpOnly cookie (browser)."
       });
     }
+    const generation = this.credentialGeneration;
     const discovery = await this.fetchDiscovery();
     const form = new URLSearchParams();
     form.set("grant_type", "refresh_token");
@@ -1021,15 +1050,18 @@ var WitniumchainClient = class {
     if (this.refreshToken) {
       form.set("refresh_token", this.refreshToken);
     }
+    let tokens;
     try {
-      const tokens = await this.postTokenEndpoint(discovery.token_endpoint, form);
-      return this.persistTokenResponse(tokens);
+      tokens = await this.postTokenEndpoint(discovery.token_endpoint, form);
     } catch (err) {
+      this.assertCredentialGeneration(generation);
       this.accessToken = void 0;
       this.refreshToken = void 0;
       this.hasRefreshCookie = false;
       throw err;
     }
+    this.assertCredentialGeneration(generation);
+    return this.persistTokenResponse(tokens);
   }
   // ────────────────────────────────────────────────────────────────────────
   // Internal: fetch wrapper that maps non-2xx → WitniumchainApiError