@witnium-tech/witniumchain 0.12.0 → 0.12.2

package/dist/index.d.mts

@@ -12044,12 +12044,12 @@ declare class WitniumchainClient {
     private refreshToken;
     private hasRefreshCookie;
     private readonly oauthClientId;
-    private pendingLogins;
     private readonly verifierStorage;
     private discoveryCache;
     private refreshInFlight;
     private accessTokenFromSession;
     private sessionExchangeInFlight;
+    private credentialGeneration;
     /** Subscriptions / billing helpers. See {@link Subscriptions}. */
     readonly subscriptions: Subscriptions;
     /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -12161,8 +12161,9 @@ declare class WitniumchainClient {
     enrollTotp(): Promise<TotpEnrollResponse>;
     /**
      * Confirming bumps the user's security epoch server-side, which ends every
-     * session-minted access token. A cached one is dropped so the next bearer
-     * call mints a fresh token.
+     * session-minted access token and OAuth artifact of the user. Cached and
+     * in-flight tokens are dropped so the next bearer call mints a fresh one
+     * from the (surviving) session.
      */
     confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
     /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
@@ -12280,6 +12281,12 @@ declare class WitniumchainClient {
      * valid session.
      */
     exchangeSessionForToken(): Promise<OAuthTokenSnapshot>;
+    private assertCredentialGeneration;
+    /**
+     * Forget every cached credential and orphan in-flight mints/refreshes, so
+     * none of them can store a token afterwards.
+     */
+    private invalidateCredentials;
     /**
      * Best-effort transparent mint for the `BearerJWT` path: if no access token
      * is cached, try the session exchange (single-flight). Swallows failure so

package/dist/index.d.ts

@@ -12044,12 +12044,12 @@ declare class WitniumchainClient {
     private refreshToken;
     private hasRefreshCookie;
     private readonly oauthClientId;
-    private pendingLogins;
     private readonly verifierStorage;
     private discoveryCache;
     private refreshInFlight;
     private accessTokenFromSession;
     private sessionExchangeInFlight;
+    private credentialGeneration;
     /** Subscriptions / billing helpers. See {@link Subscriptions}. */
     readonly subscriptions: Subscriptions;
     /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -12161,8 +12161,9 @@ declare class WitniumchainClient {
     enrollTotp(): Promise<TotpEnrollResponse>;
     /**
      * Confirming bumps the user's security epoch server-side, which ends every
-     * session-minted access token. A cached one is dropped so the next bearer
-     * call mints a fresh token.
+     * session-minted access token and OAuth artifact of the user. Cached and
+     * in-flight tokens are dropped so the next bearer call mints a fresh one
+     * from the (surviving) session.
      */
     confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
     /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
@@ -12280,6 +12281,12 @@ declare class WitniumchainClient {
      * valid session.
      */
     exchangeSessionForToken(): Promise<OAuthTokenSnapshot>;
+    private assertCredentialGeneration;
+    /**
+     * Forget every cached credential and orphan in-flight mints/refreshes, so
+     * none of them can store a token afterwards.
+     */
+    private invalidateCredentials;
     /**
      * Best-effort transparent mint for the `BearerJWT` path: if no access token
      * is cached, try the session exchange (single-flight). Swallows failure so

package/dist/index.js

@@ -94,11 +94,6 @@ var WitniumchainClient = class {
   // refresh might work even when the in-memory refresh token is undefined.
   hasRefreshCookie = false;
   oauthClientId;
-  // The redirect URI the most recent `beginOAuthLogin` issued, alongside the
-  // PKCE verifier. `completeOAuthLogin` reads it back so the token-exchange
-  // request matches the original /auth request (RFC 6749 §4.1.3 requires
-  // redirect_uri at /token to equal the one at /auth). Keyed by state.
-  pendingLogins = /* @__PURE__ */ new Map();
   verifierStorage;
   // Cache of the parsed OIDC discovery document keyed by issuer URL. Saves a
   // round trip on every OAuth call after the first. oidc-provider's discovery
@@ -121,6 +116,11 @@ var WitniumchainClient = class {
   // first BearerJWT call (and any concurrent fan-out) awaits one in-flight
   // mint rather than minting N tokens.
   sessionExchangeInFlight;
+  // Bumped whenever the cached credentials stop being valid (sign-out, the
+  // TOTP-confirm epoch bump). A mint or refresh that started under an older
+  // generation must not store its result: it could be a previous user's
+  // token, or one the server has already ended.
+  credentialGeneration = 0;
   /** Subscriptions / billing helpers. See {@link Subscriptions}. */
   subscriptions;
   /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -502,18 +502,16 @@ var WitniumchainClient = class {
   }
   /**
    * Confirming bumps the user's security epoch server-side, which ends every
-   * session-minted access token. A cached one is dropped so the next bearer
-   * call mints a fresh token.
+   * session-minted access token and OAuth artifact of the user. Cached and
+   * in-flight tokens are dropped so the next bearer call mints a fresh one
+   * from the (surviving) session.
    */
   async confirmTotp(body) {
     const res = await this.req("POST", "/v1/account/mfa/totp/confirm", {
       auth: "SessionCookie",
       body
     });
-    if (this.accessTokenFromSession) {
-      this.accessToken = void 0;
-      this.accessTokenFromSession = false;
-    }
+    this.invalidateCredentials();
     return res;
   }
   /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
@@ -563,7 +561,9 @@ var WitniumchainClient = class {
   // Routing: every method here passes `service: 'chain'` to `req()`. Calls
   // throw at call time if `chainBaseUrl` wasn't configured.
   //
-  // Auth: BearerJWT. The accounts-issued OAuth access token already carries
+  // Auth: the contract, witness, transaction and wallet reads are public on
+  // chain-api (anyone can check a witness), so they send no credential. The
+  // dashboard reads are BearerJWT: the accounts-issued token already carries
   // `aud=https://api.witniumchain.com`, so the same `accessToken` works
   // unchanged against both services.
   //
@@ -577,49 +577,49 @@ var WitniumchainClient = class {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/info`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getContractVerification(contractAddress) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/verify`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   listWitnessesV5(contractAddress, params) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/witnesses`,
-      { auth: "BearerJWT", service: "chain", query: params }
+      { auth: "Public", service: "chain", query: params }
     );
   }
   getWitnessV5(contractAddress, witnessId) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/witnesses/${encodeURIComponent(witnessId)}`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getContractTransaction(contractAddress, txHash) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/transactions/${encodeURIComponent(txHash)}`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getTransaction(txHash) {
     return this.req(
       "GET",
       `/v5/transactions/${encodeURIComponent(txHash)}`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getWalletBalance(address) {
     return this.req(
       "GET",
       `/v5/wallets/${encodeURIComponent(address)}/balance`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getDashboardContract() {
@@ -699,8 +699,9 @@ var WitniumchainClient = class {
     url.searchParams.set("code_challenge", challenge);
     url.searchParams.set("code_challenge_method", "S256");
     if (args.prompt) url.searchParams.set("prompt", args.prompt);
-    this.verifierStorageOrDefault().set(state, verifier);
-    this.pendingLogins.set(state, { redirectUri: args.redirectUri });
+    const storage = this.verifierStorageOrDefault();
+    storage.set(state, verifier);
+    storage.set(redirectUriKey(state), args.redirectUri);
     return { authorizationUrl: url.toString(), state };
   }
   /**
@@ -753,24 +754,24 @@ var WitniumchainClient = class {
         message: "WitniumchainClient: no PKCE verifier stored for this `state`. The login flow either was not started in this tab, was already completed, or the sessionStorage entry was cleared."
       });
     }
-    const pending = this.pendingLogins.get(state);
-    if (!pending) {
+    const redirectUri = storage.get(redirectUriKey(state));
+    if (!redirectUri) {
       storage.remove(state);
       throw new WitniumchainApiError({
         status: 0,
-        message: "WitniumchainClient: PKCE verifier exists but the redirectUri for this `state` was not found in client memory (the client instance was replaced between beginOAuthLogin and completeOAuthLogin)."
+        message: "WitniumchainClient: PKCE verifier exists but the redirectUri stored with it for this `state` is missing."
       });
     }
     const discovery = await this.fetchDiscovery();
     const form = new URLSearchParams();
     form.set("grant_type", "authorization_code");
     form.set("code", code);
-    form.set("redirect_uri", pending.redirectUri);
+    form.set("redirect_uri", redirectUri);
     form.set("client_id", this.oauthClientId);
     form.set("code_verifier", verifier);
     const tokens = await this.postTokenEndpoint(discovery.token_endpoint, form);
     storage.remove(state);
-    this.pendingLogins.delete(state);
+    storage.remove(redirectUriKey(state));
     return this.persistTokenResponse(tokens);
   }
   /**
@@ -791,14 +792,16 @@ var WitniumchainClient = class {
    */
   async refreshAccessToken() {
     if (this.refreshInFlight) return this.refreshInFlight;
-    this.refreshInFlight = (async () => {
+    let flight = void 0;
+    flight = (async () => {
       try {
         return await this.refreshAccessTokenInternal();
       } finally {
-        this.refreshInFlight = void 0;
+        if (this.refreshInFlight === flight) this.refreshInFlight = void 0;
       }
     })();
-    return this.refreshInFlight;
+    this.refreshInFlight = flight;
+    return flight;
   }
   /**
    * Exchange the logged-in session (the `wac_session` cookie) for a short-lived
@@ -823,9 +826,12 @@ var WitniumchainClient = class {
    */
   async exchangeSessionForToken() {
     if (this.sessionExchangeInFlight) return this.sessionExchangeInFlight;
-    this.sessionExchangeInFlight = (async () => {
+    const generation = this.credentialGeneration;
+    let flight = void 0;
+    flight = (async () => {
       try {
         const res = await this.req("POST", "/v1/auth/access-token", { auth: "SessionCookie" });
+        this.assertCredentialGeneration(generation);
         this.accessToken = res.accessToken;
         this.accessTokenFromSession = true;
         this.refreshToken = void 0;
@@ -835,10 +841,32 @@ var WitniumchainClient = class {
           expiresAt: Math.floor(new Date(res.expiresAt).getTime() / 1e3)
         };
       } finally {
-        this.sessionExchangeInFlight = void 0;
+        if (this.sessionExchangeInFlight === flight) this.sessionExchangeInFlight = void 0;
       }
     })();
-    return this.sessionExchangeInFlight;
+    this.sessionExchangeInFlight = flight;
+    return flight;
+  }
+  assertCredentialGeneration(generation) {
+    if (generation !== this.credentialGeneration) {
+      throw new WitniumchainApiError({
+        status: 0,
+        message: "WitniumchainClient: the session changed (sign-out or MFA confirmation) while a token request was in flight; its token was discarded."
+      });
+    }
+  }
+  /**
+   * Forget every cached credential and orphan in-flight mints/refreshes, so
+   * none of them can store a token afterwards.
+   */
+  invalidateCredentials() {
+    this.credentialGeneration++;
+    this.accessToken = void 0;
+    this.accessTokenFromSession = false;
+    this.refreshToken = void 0;
+    this.hasRefreshCookie = false;
+    this.sessionExchangeInFlight = void 0;
+    this.refreshInFlight = void 0;
   }
   /**
    * Best-effort transparent mint for the `BearerJWT` path: if no access token
@@ -850,7 +878,8 @@ var WitniumchainClient = class {
     if (this.accessToken) return;
     try {
       await this.exchangeSessionForToken();
-    } catch {
+    } catch (err) {
+      if (!(err instanceof WitniumchainApiError && err.status === 401)) throw err;
     }
   }
   /**
@@ -891,11 +920,7 @@ var WitniumchainClient = class {
    * dropped — which it is, here.
    */
   signOut() {
-    this.accessToken = void 0;
-    this.accessTokenFromSession = false;
-    this.refreshToken = void 0;
-    this.hasRefreshCookie = false;
-    this.pendingLogins.clear();
+    this.invalidateCredentials();
   }
   // ────────────────────────────────────────────────────────────────────────
   // Internal: OAuth flow helpers
@@ -1014,6 +1039,7 @@ var WitniumchainClient = class {
         message: "WitniumchainClient: no refresh credential available. Call `completeOAuthLogin` first \u2014 the server delivers the refresh token either in the response body (Node) or as an HttpOnly cookie (browser)."
       });
     }
+    const generation = this.credentialGeneration;
     const discovery = await this.fetchDiscovery();
     const form = new URLSearchParams();
     form.set("grant_type", "refresh_token");
@@ -1021,15 +1047,18 @@ var WitniumchainClient = class {
     if (this.refreshToken) {
       form.set("refresh_token", this.refreshToken);
     }
+    let tokens;
     try {
-      const tokens = await this.postTokenEndpoint(discovery.token_endpoint, form);
-      return this.persistTokenResponse(tokens);
+      tokens = await this.postTokenEndpoint(discovery.token_endpoint, form);
     } catch (err) {
+      this.assertCredentialGeneration(generation);
       this.accessToken = void 0;
       this.refreshToken = void 0;
       this.hasRefreshCookie = false;
       throw err;
     }
+    this.assertCredentialGeneration(generation);
+    return this.persistTokenResponse(tokens);
   }
   // ────────────────────────────────────────────────────────────────────────
   // Internal: fetch wrapper that maps non-2xx → WitniumchainApiError
@@ -1472,6 +1501,9 @@ var MfaRecoveryCodes = class {
     return this.client.regenerateRecoveryCodes(proof);
   }
 };
+function redirectUriKey(state) {
+  return `${state}.redirect_uri`;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }