@zauru-sdk/utils 6.22.1 → 6.24.0

package/dist/esm/zauru/auth.loaders.js

@@ -1,6 +1,7 @@
 import { redirect } from "@remix-run/node";
+import { isOauthUserinfoUnauthorizedError } from "@zauru-sdk/common";
 import { config } from "@zauru-sdk/config";
-import { commitSession, destroySession, getRefreshSession, getSession, loginWebApp, } from "@zauru-sdk/services";
+import { commitSession, destroySession, getHeaders, getRefreshSession, getSession, loginWebApp, } from "@zauru-sdk/services";
 const loginErrorPayload = (description, title) => ({
     error: true,
     type: "error",
@@ -9,11 +10,39 @@ const loginErrorPayload = (description, title) => ({
     description,
 });
 const isDenied = (result) => result === false;
+const isResponse = (value) => typeof Response !== "undefined" && value instanceof Response;
+const deniedLoginPayload = () => loginErrorPayload("No tienes permiso para acceder a esta aplicación. Si crees que esto es un error, contacta al administrador.", "Acceso denegado");
+const evaluateLoginAccess = async (extras, session, headers) => {
+    try {
+        if (isDenied(await extras?.requireAccess?.(session, headers))) {
+            return Response.json(deniedLoginPayload());
+        }
+        return null;
+    }
+    catch (error) {
+        if (isResponse(error)) {
+            throw error;
+        }
+        const description = error instanceof Error ? error.message : String(error);
+        return Response.json(loginErrorPayload(description));
+    }
+};
+const OAUTH_REAUTH_COOKIE = "zauru_oauth_reauth";
 const authorizeUrl = (request) => {
     const url = new URL(request.url);
     const hostname = `${url.port ? "http://" : "https://"}${url.hostname}${url.port ? `:${url.port}` : ""}`;
     return `${config.oauthBaseURL}/dialog/authorize?client_id=${config.oauthClientID}&response_type=code&redirect_uri=${hostname}/login`;
 };
+const hasOauthReauthCookie = (request) => (request.headers.get("Cookie") ?? "")
+    .split(";")
+    .some((part) => part.trim() === `${OAUTH_REAUTH_COOKIE}=1`);
+const oauthReauthSetCookie = () => `${OAUTH_REAUTH_COOKIE}=1; Path=/; Max-Age=120; SameSite=Lax`;
+const redirectOauthReauth = async (session) => {
+    const headers = new Headers();
+    headers.append("Set-Cookie", await destroySession(session));
+    headers.append("Set-Cookie", oauthReauthSetCookie());
+    return redirect("/logout?reauth=1", { headers });
+};
 export function createLoginLoader() {
     return async () => Response.json({});
 }
@@ -21,6 +50,10 @@ export function createLoginLoader() {
  * Remix action for `/login`: OAuth authorize, `loginWebApp`, cookie commit.
  * `afterLogin` runs before `commitSession`. `requireAccess` can deny after
  * a successful OAuth exchange or when a session already has `code`.
+ *
+ * HTTP 401 on `/api/userinfo` (expired/stale `code`) clears the Remix session
+ * and redirects to `/logout?reauth=1` so `/login` can request a new code.
+ * A 120s `zauru_oauth_reauth` cookie prevents a loop if OAuth keeps failing.
  */
 export function createLoginAction(extras) {
     return async ({ request }) => {
@@ -41,17 +74,32 @@ export function createLoginAction(extras) {
             return redirect(authorizeUrl(request));
         }
         if (session.has("code")) {
-            if (isDenied(await extras?.requireAccess?.(session))) {
+            const existingHeaders = await getHeaders(null, session);
+            try {
+                if (isDenied(await extras?.requireAccess?.(session, existingHeaders))) {
+                    return redirect("/");
+                }
+            }
+            catch (error) {
+                if (isResponse(error)) {
+                    throw error;
+                }
                 return redirect("/");
             }
             return redirect("/home");
         }
         const loginResponse = await loginWebApp(session, codeValue, cookie);
         if (loginResponse.error || !loginResponse.data) {
-            return Response.json(loginErrorPayload(loginResponse.userMsg?.toString() ?? ""));
+            const userMsg = loginResponse.userMsg?.toString() ?? "";
+            if (isOauthUserinfoUnauthorizedError(userMsg) &&
+                !hasOauthReauthCookie(request)) {
+                return redirectOauthReauth(session);
+            }
+            return Response.json(loginErrorPayload(userMsg));
         }
-        if (isDenied(await extras?.requireAccess?.(session))) {
-            return Response.json(loginErrorPayload("No tienes permiso para acceder a esta aplicación. Si crees que esto es un error, contacta al administrador.", "Acceso denegado"));
+        const denied = await evaluateLoginAccess(extras, session, loginResponse.data.headers);
+        if (denied) {
+            return denied;
         }
         if (extras?.afterLogin) {
             await extras.afterLogin({
@@ -78,14 +126,27 @@ export function createSessionGuardLoader(extras) {
         if (!session.has("username")) {
             return redirect("/");
         }
-        if (isDenied(await extras?.requireAccess?.(session))) {
+        const headers = await getHeaders(null, session);
+        if (isDenied(await extras?.requireAccess?.(session, headers))) {
             return redirect("/");
         }
         return Response.json({});
     };
 }
 export function createLogoutLoader(extras) {
-    return createSessionGuardLoader(extras);
+    const guard = createSessionGuardLoader(extras);
+    return async (args) => {
+        const url = new URL(args.request.url);
+        if (url.searchParams.get("reauth") === "1") {
+            const session = await getSession(args.request.headers.get("Cookie"));
+            return redirect("/login", {
+                headers: {
+                    "Set-Cookie": await destroySession(session),
+                },
+            });
+        }
+        return guard(args);
+    };
 }
 export function createLogoutAction() {
     return async ({ request }) => {
@@ -104,7 +165,8 @@ export function createIndexLoader(extras) {
     return async ({ request }) => {
         const session = await getSession(request.headers.get("Cookie"));
         if (session.has("username")) {
-            if (isDenied(await extras?.requireAccess?.(session))) {
+            const headers = await getHeaders(null, session);
+            if (isDenied(await extras?.requireAccess?.(session, headers))) {
                 return Response.json({});
             }
             return redirect("/home");
@@ -121,7 +183,8 @@ export function createReloadCatalogsLoader(extras) {
         if (!session.has("username")) {
             return redirect("/");
         }
-        if (isDenied(await extras?.requireAccess?.(session))) {
+        const headers = await getHeaders(null, session);
+        if (isDenied(await extras?.requireAccess?.(session, headers))) {
             return redirect("/");
         }
         try {

package/dist/esm/zauru/rbac/createWebappRbac.js

@@ -1,6 +1,6 @@
 import { redirect } from "@remix-run/node";
 import { handlePossibleAxiosErrors } from "@zauru-sdk/common";
-import { createWebAppTableRegister, getVariablesByName, getWebAppRow, getWebAppTableRegisters, updateWebAppTableRegister, } from "@zauru-sdk/services";
+import { createWebAppTableRegister, getHeaders, getVariablesByName, getWebAppRow, getWebAppTableRegisters, updateWebAppTableRegister, } from "@zauru-sdk/services";
 import { hasPermission as hasPermissionInContext, isActiveWebappRow, isSuperAdminEmail, } from "./access.js";
 import { DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES, isValidPermissionKey, normalizePermissionKeys, } from "./catalog.js";
 const deletedAt = () => new Date().toISOString();
@@ -11,11 +11,14 @@ const toNumber = (value) => {
 export function createWebappRbac(config) {
     const suffixes = config.superAdminEmailSuffixes ?? DEFAULT_SUPER_ADMIN_EMAIL_SUFFIXES;
     const validKeys = new Set(config.allPermissionKeys);
+    const resolveHeaders = async (headers, session) => {
+        if (headers?.["X-User-Token"] || headers?.["x-user-token"]) {
+            return headers;
+        }
+        return getHeaders(null, session);
+    };
     const getTableIds = async (headers, session) => {
-        const vars = await getVariablesByName(headers, session, [
-            config.rolesTableVar,
-            config.employeeRolesTableVar,
-        ]);
+        const vars = await getVariablesByName(await resolveHeaders(headers, session), session, [config.rolesTableVar, config.employeeRolesTableVar]);
         return {
             rolesTableId: vars[config.rolesTableVar],
             employeeRolesTableId: vars[config.employeeRolesTableVar],
@@ -210,6 +213,7 @@ export function createWebappRbac(config) {
         const context = await resolveAccess(headers, session);
         return context != null;
     };
+    const hasAppAccessFromSession = (session) => hasAppAccess(undefined, session);
     const requireAppAccess = async (headers, session) => {
         if (!session.has("username")) {
             throw redirect("/");
@@ -220,6 +224,7 @@ export function createWebappRbac(config) {
         }
         return context;
     };
+    const requireAppAccessFromSession = (session) => requireAppAccess(undefined, session);
     const requirePermission = async (headers, session, key) => {
         const context = await requireAppAccess(headers, session);
         if (!hasPermissionInContext(context, key)) {
@@ -240,7 +245,9 @@ export function createWebappRbac(config) {
         assignEmployeeRole,
         resolveAccess,
         hasAppAccess,
+        hasAppAccessFromSession,
         requireAppAccess,
+        requireAppAccessFromSession,
         requirePermission,
         hasPermission: hasPermissionInContext,
         isSuperAdminEmail: (email) => isSuperAdminEmail(email, suffixes),

package/dist/zauru/auth.loaders.d.ts

@@ -6,8 +6,12 @@ export type AuthAccessExtras = {
     /**
      * Return `false` to deny. Throw `redirect(...)` to send the user elsewhere.
      * Any other return (including `void`) allows access.
+     *
+     * `headers` is present after a successful `loginWebApp`; otherwise it is
+     * built from the session (`X-User-Email` / `X-User-Token`). Prefer
+     * `rbac.hasAppAccessFromSession` so callers do not pass `{}`.
      */
-    requireAccess?: (session: AuthSession) => boolean | void | Promise<boolean | void>;
+    requireAccess?: (session: AuthSession, headers?: Record<string, string>) => boolean | void | Promise<boolean | void>;
 };
 export type LoginActionExtras = AuthAccessExtras & {
     afterLogin?: (ctx: {
@@ -22,6 +26,10 @@ export declare function createLoginLoader(): LoaderFunction;
  * Remix action for `/login`: OAuth authorize, `loginWebApp`, cookie commit.
  * `afterLogin` runs before `commitSession`. `requireAccess` can deny after
  * a successful OAuth exchange or when a session already has `code`.
+ *
+ * HTTP 401 on `/api/userinfo` (expired/stale `code`) clears the Remix session
+ * and redirects to `/logout?reauth=1` so `/login` can request a new code.
+ * A 120s `zauru_oauth_reauth` cookie prevents a loop if OAuth keeps failing.
  */
 export declare function createLoginAction(extras?: LoginActionExtras): ActionFunction;
 /**

package/dist/zauru/rbac/createWebappRbac.d.ts

@@ -29,7 +29,9 @@ export declare function createWebappRbac(config: WebappRbacConfig): {
     assignEmployeeRole: (headers: any, session: Session, body: AssignEmployeeRoleInput) => Promise<AxiosUtilsResponse<WebAppTableUpdateResponse>>;
     resolveAccess: (headers: any, session: Session) => Promise<WebappAccessContext | null>;
     hasAppAccess: (headers: any, session: Session) => Promise<boolean>;
+    hasAppAccessFromSession: (session: Session) => Promise<boolean>;
     requireAppAccess: (headers: any, session: Session) => Promise<WebappAccessContext>;
+    requireAppAccessFromSession: (session: Session) => Promise<WebappAccessContext>;
     requirePermission: (headers: any, session: Session, key: string) => Promise<WebappAccessContext>;
     hasPermission: typeof hasPermissionInContext;
     isSuperAdminEmail: (email: string | null | undefined) => boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zauru-sdk/utils",
-  "version": "6.22.1",
+  "version": "6.24.0",
   "description": "Utilidades, parseo de request y demás para desarrollo de webapps de Zauru",
   "main": "./dist/esm/index.js",
   "module": "./dist/esm/index.js",
@@ -71,12 +71,12 @@
   "dependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.1123.0",
     "@remix-run/node": "^2.8.1",
-    "@zauru-sdk/common": "^6.8.6",
+    "@zauru-sdk/common": "^6.9.0",
     "@zauru-sdk/config": "^6.0.0",
     "@zauru-sdk/graphql": "^6.8.0",
-    "@zauru-sdk/services": "^6.11.9",
+    "@zauru-sdk/services": "^6.11.10",
     "@zauru-sdk/types": "^6.24.0",
     "moment": "^2.30.1"
   },
-  "gitHead": "d1667a29d9fabc9980d171fed30796c232de358d"
+  "gitHead": "a46ebe234551d76d6a0ea9095be6e55540006ab3"
 }