astro-tokenkit 1.0.18 → 1.0.20

package/dist/middleware.cjs

@@ -370,6 +370,7 @@ function isExpired(expiresAt, now, policy = {}) {
 }
 
 // packages/astro-tokenkit/src/utils/fetch.ts
+let sharedInsecureAgent = null;
 /**
  * Perform a fetch request with optional certificate validation bypass
  */
@@ -378,16 +379,26 @@ function safeFetch(url, init, config) {
         const fetchFn = config.fetch || fetch;
         const fetchOptions = Object.assign({}, init);
         if (config.dangerouslyIgnoreCertificateErrors && typeof process !== 'undefined') {
-            // In Node.js environment
             try {
-                // Try to use undici Agent if available (it is built-in in Node 18+)
-                // However, we might need to import it if we want to create an Agent.
-                // Since we don't want to depend on undici in package.json, we use dynamic import.
-                // But wait, undici's Agent is what we need.
-                // As a fallback and most reliable way for self-signed certs in Node without extra deps:
-                process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-                // NOTE: This affects the whole process. We should ideally only do this if it's not already 0.
-                // But for a dev tool / specialized library, it's often what's needed.
+                // Try to use undici Agent if available to avoid global process.env changes
+                if (!sharedInsecureAgent) {
+                    // @ts-ignore
+                    const undici = yield import('undici').catch(() => null);
+                    if (undici && undici.Agent) {
+                        sharedInsecureAgent = new undici.Agent({
+                            connect: { rejectUnauthorized: false }
+                        });
+                    }
+                }
+                if (sharedInsecureAgent) {
+                    fetchOptions.dispatcher = sharedInsecureAgent;
+                }
+                else {
+                    // Fallback to global setting (less secure, but only way without undici)
+                    if (process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0') {
+                        process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+                    }
+                }
             }
             catch (e) {
                 // Ignore
@@ -432,21 +443,18 @@ class SingleFlight {
             const existing = this.inFlight.get(key);
             if (existing)
                 return existing;
-            const promise = this.doExecute(key, fn);
+            const promise = (() => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    return yield fn();
+                }
+                finally {
+                    this.inFlight.delete(key);
+                }
+            }))();
             this.inFlight.set(key, promise);
             return promise;
         });
     }
-    doExecute(key, fn) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                return yield fn();
-            }
-            finally {
-                this.inFlight.delete(key);
-            }
-        });
-    }
 }
 /**
  * Token Manager handles all token operations
@@ -462,6 +470,7 @@ class TokenManager {
      */
     login(ctx, credentials, options) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const url = this.joinURL(this.baseURL, this.config.login);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), options === null || options === void 0 ? void 0 : options.headers);
@@ -473,12 +482,16 @@ class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
+            const timeout = (_b = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this.config.timeout) !== null && _b !== void 0 ? _b : 30000;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeout);
             let response;
             try {
                 response = yield safeFetch(url, {
                     method: 'POST',
                     headers,
                     body: requestBody,
+                    signal: controller.signal,
                 }, this.config);
             }
             catch (error) {
@@ -487,6 +500,9 @@ class TokenManager {
                     yield options.onError(authError, ctx);
                 throw authError;
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
             if (!response.ok) {
                 const authError = new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
                 if (options === null || options === void 0 ? void 0 : options.onError)
@@ -542,6 +558,7 @@ class TokenManager {
      */
     performRefresh(ctx, refreshToken, options, extraHeaders) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const url = this.joinURL(this.baseURL, this.config.refresh);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), extraHeaders);
@@ -554,17 +571,24 @@ class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
+            const timeout = (_b = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this.config.timeout) !== null && _b !== void 0 ? _b : 30000;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeout);
             let response;
             try {
                 response = yield safeFetch(url, {
                     method: 'POST',
                     headers,
                     body: requestBody,
+                    signal: controller.signal,
                 }, this.config);
             }
             catch (error) {
                 throw new AuthError(`Refresh request failed: ${error.message}`, undefined, undefined, undefined, error);
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
             if (!response.ok) {
                 // 401/403 = invalid refresh token
                 if (response.status === 401 || response.status === 403) {
@@ -596,8 +620,8 @@ class TokenManager {
     /**
      * Ensure valid tokens (with automatic refresh)
      */
-    ensure(ctx, options, headers) {
-        return __awaiter(this, void 0, void 0, function* () {
+    ensure(ctx_1, options_1, headers_1) {
+        return __awaiter(this, arguments, void 0, function* (ctx, options, headers, force = false) {
             var _a, _b, _c, _d, _e, _f;
             const now = Math.floor(Date.now() / 1000);
             const tokens = retrieveTokens(ctx, this.config.cookies);
@@ -605,12 +629,14 @@ class TokenManager {
             if (!tokens.accessToken || !tokens.refreshToken || !tokens.expiresAt) {
                 return null;
             }
-            // Token expired
-            if (isExpired(tokens.expiresAt, now, this.config.policy)) {
+            // Token expired or force refresh
+            if (force || isExpired(tokens.expiresAt, now, this.config.policy)) {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
                 const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (!bundle)
                     return null;
+                // Ensure tokens are stored in the current context (in case of shared flight)
+                storeTokens(ctx, bundle, this.config.cookies);
                 return {
                     accessToken: bundle.accessToken,
                     expiresAt: bundle.accessExpiresAt,
@@ -623,6 +649,8 @@ class TokenManager {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
                 const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (bundle) {
+                    // Ensure tokens are stored in the current context (in case of shared flight)
+                    storeTokens(ctx, bundle, this.config.cookies);
                     return {
                         accessToken: bundle.accessToken,
                         expiresAt: bundle.accessExpiresAt,
@@ -650,23 +678,33 @@ class TokenManager {
      */
     logout(ctx) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+            var _a, _b;
             // Optionally call logout endpoint
             if (this.config.logout) {
+                const timeout = (_a = this.config.timeout) !== null && _a !== void 0 ? _a : 10000;
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), timeout);
                 try {
                     const url = this.joinURL(this.baseURL, this.config.logout);
                     const session = this.getSession(ctx);
                     const headers = {};
                     if (session === null || session === void 0 ? void 0 : session.accessToken) {
-                        const injectFn = (_a = this.config.injectToken) !== null && _a !== void 0 ? _a : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                        const injectFn = (_b = this.config.injectToken) !== null && _b !== void 0 ? _b : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
                         headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
                     }
-                    yield safeFetch(url, { method: 'POST', headers }, this.config);
+                    yield safeFetch(url, {
+                        method: 'POST',
+                        headers,
+                        signal: controller.signal,
+                    }, this.config);
                 }
                 catch (error) {
                     // Ignore logout endpoint errors
                     logger.debug('[TokenKit] Logout endpoint failed:', error);
                 }
+                finally {
+                    clearTimeout(timeoutId);
+                }
             }
             clearTokens(ctx, this.config.cookies);
         });