cabloy 5.1.242 → 5.1.244

package/vona/src/suite-vendor/a-vona/modules/a-user/src/bean/bean.passport.ts

@@ -10,13 +10,19 @@ import { catchError, isNil } from '@cabloy/utils';
 import { BeanBase, beanFullNameFromOnionName } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 
-import type { IAuth, IAuthIdRecord, IAuthTokenOptions, ISigninOptions } from '../types/auth.ts';
+import type {
+  IAuth,
+  IAuthIdRecord,
+  IAuthTokenOptions,
+  ISigninOptions,
+  TypeAuthTokenMode,
+} from '../types/auth.ts';
 import type { IAuthTokenAdapter } from '../types/authToken.ts';
 import type { IPassport, IPassportAdapter } from '../types/passport.ts';
 import type { IRole, IRoleNameRecord } from '../types/role.ts';
 import type { IUser, IUserNameRecord } from '../types/user.ts';
 
-import { $getAuthIdSystem } from '../lib/auth.ts';
+import { $getAuthIdSystem, $getAuthTokenMode } from '../lib/auth.ts';
 
 @Bean()
 export class BeanPassport extends BeanBase {
@@ -43,6 +49,10 @@ export class BeanPassport extends BeanBase {
     return this._passportAdapter;
   }
 
+  public get authTokenMode(): TypeAuthTokenMode {
+    return $getAuthTokenMode(this.scope.config.authToken);
+  }
+
   public get isAuthenticated(): boolean {
     const user = this.currentUser;
     return !!user && !user.anonymous;
@@ -71,6 +81,7 @@ export class BeanPassport extends BeanBase {
   }
 
   public async setCurrent(passport: IPassport | undefined) {
+    this.ctx.state.passportPayloadData = undefined;
     this.ctx.state.passport = await this.passportAdapter.setCurrent(passport);
   }
 
@@ -107,9 +118,13 @@ export class BeanPassport extends BeanBase {
         ttl: this.scope.config.authToken.ttl,
       },
     );
-    const payloadData = await this._passportSerialize(passport, authTokenOptions);
+    const payloadData = await this._passportSerialize(passport, authTokenOptions, true);
     // jwt token
-    return await this.bean.jwt.create(payloadData, { dev: passport.auth?.id.toString() === '-1' });
+    const jwt = await this.bean.jwt.create(payloadData, {
+      dev: passport.auth?.id.toString() === '-1',
+    });
+    this.ctx.state.passportPayloadData = payloadData;
+    return jwt;
   }
 
   public async signout(): Promise<void> {
@@ -117,7 +132,10 @@ export class BeanPassport extends BeanBase {
     const passport = this.current;
     if (!passport) return;
     // removeAuthToken
-    const payloadData = await this.passportAdapter.serialize(passport);
+    const payloadData =
+      this.authTokenMode === 'session'
+        ? this._getCurrentPayloadData()
+        : await this.passportAdapter.serialize(passport);
     await this.authTokenAdapter.remove(payloadData);
     // event
     await this.scope.event.signout.emit(passport);
@@ -191,6 +209,7 @@ export class BeanPassport extends BeanBase {
     }
     // setCurrent
     await this.setCurrent(passport);
+    this.ctx.state.passportPayloadData = payloadData;
     return { payloadData, passport };
   }
 
@@ -211,7 +230,9 @@ export class BeanPassport extends BeanBase {
     );
     payloadData = await this._handlePayloadData(payloadData, authTokenOptions);
     // jwt token
-    return await this.bean.jwt.create(payloadData);
+    const jwt = await this.bean.jwt.create(payloadData);
+    this.ctx.state.passportPayloadData = payloadData;
+    return jwt;
   }
 
   // only created by accessToken
@@ -247,7 +268,10 @@ export class BeanPassport extends BeanBase {
 
   public async createOauthCodeFromOauthAuthToken(accessToken: string, options?: IJwtSignOptions) {
     // payloadData
-    const payloadData = await this.bean.jwt.get('access').verify(accessToken);
+    const payloadData =
+      this.authTokenMode === 'session'
+        ? (await this.checkAuthToken(accessToken))?.payloadData
+        : await this.bean.jwt.get('access').verify(accessToken);
     if (!payloadData) return this.app.throw(401);
     // code
     return await this.bean.jwt.createOauthCode(payloadData, options);
@@ -282,7 +306,24 @@ export class BeanPassport extends BeanBase {
     return true;
   }
 
-  private async _passportSerialize(passport: IPassport, authTokenOptions?: IAuthTokenOptions) {
+  private _getCurrentPayloadData(): IPayloadData {
+    const payloadData = this.ctx.state.passportPayloadData;
+    if (!payloadData?.[this.scope.config.payloadData.fields.token]) return this.app.throw(401);
+    return payloadData;
+  }
+
+  private async _passportSerialize(
+    passport: IPassport,
+    authTokenOptions?: IAuthTokenOptions,
+    signin = false,
+  ) {
+    if (this.authTokenMode === 'session') {
+      if (signin) {
+        const payloadData = await this.passportAdapter.serialize(passport);
+        return await this.authTokenAdapter.create(payloadData, authTokenOptions?.ttl);
+      }
+      return await this._handlePayloadData(this._getCurrentPayloadData(), authTokenOptions);
+    }
     // serialize
     const payloadData = await this.passportAdapter.serialize(passport);
     return await this._handlePayloadData(payloadData, authTokenOptions);
@@ -296,6 +337,18 @@ export class BeanPassport extends BeanBase {
     const stateless = authTokenOptions?.stateless;
     const strategy = authTokenOptions?.strategy ?? 'refresh';
     const ttl = authTokenOptions?.ttl;
+    if (this.authTokenMode === 'session') {
+      if (stateless) throw new Error('Session auth-token mode requires stateful authentication');
+      if (strategy === 'reissue') {
+        throw new Error('Session auth-token mode does not support the reissue refresh strategy');
+      }
+      const verified = await this.authTokenAdapter.verify(payloadData);
+      if (!verified) return this.app.throw(401);
+      if (strategy === 'refresh') {
+        await this.authTokenAdapter.refresh(payloadData, ttl);
+      }
+      return payloadData;
+    }
     if (stateless) {
       // do nothing
       return payloadData;
@@ -320,17 +373,26 @@ export class BeanPassport extends BeanBase {
     authTokenOptionsCustom: IAuthTokenOptions | undefined,
     authTokenOptionsDefault: IAuthTokenOptions,
   ) {
-    if (!authProviderId) return authTokenOptionsDefault;
-    const { clientOptions } = await this.bean.authProvider.getClientOptions(
-      {
-        id: authProviderId,
-      },
-      { authTokenOptions: authTokenOptionsCustom ?? {} },
-      {
-        authTokenOptions: authTokenOptionsDefault,
-      },
-    );
-    if (!clientOptions) this.app.throw(403);
-    return clientOptions.authTokenOptions!;
+    let authTokenOptions = authTokenOptionsDefault;
+    if (this.authTokenMode === 'session') {
+      authTokenOptions = { ...authTokenOptions, ...authTokenOptionsCustom };
+    }
+    if (authProviderId) {
+      const { clientOptions } = await this.bean.authProvider.getClientOptions(
+        {
+          id: authProviderId,
+        },
+        { authTokenOptions: authTokenOptionsCustom ?? {} },
+        {
+          authTokenOptions: authTokenOptionsDefault,
+        },
+      );
+      if (!clientOptions) this.app.throw(403);
+      authTokenOptions = clientOptions.authTokenOptions!;
+    }
+    if (this.authTokenMode === 'session' && authTokenOptions.stateless) {
+      throw new Error('Session auth-token mode requires stateful authentication');
+    }
+    return authTokenOptions;
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-user/src/config/config.ts

@@ -2,12 +2,15 @@ import type { VonaApplication } from 'vona';
 
 import type { ConfigUser } from '../types/auth.ts';
 
-export function config(_app: VonaApplication) {
+import { $parseAuthTokenMode } from '../lib/auth.ts';
+
+export function config(app: VonaApplication) {
   const configUser: ConfigUser = {
     user: {
       autoActivate: false,
     },
     authToken: {
+      mode: $parseAuthTokenMode(app.meta.env.AUTH_TOKEN_MODE),
       stateless: false,
       strategy: {
         refreshAuthToken: 'refresh',

package/vona/src/suite-vendor/a-vona/modules/a-user/src/lib/auth.ts

@@ -1,6 +1,25 @@
 import type { TableIdentity } from 'table-identity';
 
-import type { IAuthIdRecord } from '../types/auth.ts';
+import type { IAuthIdRecord, IAuthTokenConfig, TypeAuthTokenMode } from '../types/auth.ts';
+
+export function $parseAuthTokenMode(value: unknown): TypeAuthTokenMode {
+  if (value === undefined) return 'auth';
+  if (value === 'auth' || value === 'session') return value;
+  throw new Error('AUTH_TOKEN_MODE / authToken.mode must be auth or session');
+}
+
+export function $getAuthTokenMode(config: IAuthTokenConfig): TypeAuthTokenMode {
+  const mode = $parseAuthTokenMode(config.mode);
+  if (mode === 'session') {
+    if (config.stateless) {
+      throw new Error('Session auth-token mode requires stateful authentication');
+    }
+    if (config.strategy.refreshAuthToken === 'reissue') {
+      throw new Error('Session auth-token mode does not support the reissue refresh strategy');
+    }
+  }
+  return mode;
+}
 
 export function $getAuthIdSystem<K extends keyof IAuthIdRecord>(
   _authName: IAuthIdRecord[K],

package/vona/src/suite-vendor/a-vona/modules/a-user/src/main.ts

@@ -2,9 +2,12 @@ import type { IModuleMain, VonaContext } from 'vona';
 
 import { BeanSimple } from 'vona';
 
+import { $getAuthTokenMode } from './lib/auth.ts';
+
 export class Main extends BeanSimple implements IModuleMain {
   async moduleLoading() {}
   async moduleLoaded() {
+    $getAuthTokenMode(this.app.config.modules['a-user'].authToken);
     // user
     Object.defineProperty(this.app.context, 'user', {
       enumerable: false,

package/vona/src/suite-vendor/a-vona/modules/a-user/src/service/authTokenAdapter.ts

@@ -10,7 +10,10 @@ import type { IUser } from '../types/user.ts';
 export class ServiceAuthTokenAdapter extends BeanBase implements IAuthTokenAdapter {
   async create(payloadData: IPayloadData, ttl?: number): Promise<IPayloadData> {
     const authIdStr = this._getAuthId(payloadData)?.toString();
-    const token = authIdStr === '-1' ? createHash(authIdStr) : uuidv4();
+    const token =
+      this.bean.passport.authTokenMode === 'auth' && authIdStr === '-1'
+        ? createHash(authIdStr)
+        : uuidv4();
     const payloadDataNew = Object.assign({}, payloadData, {
       [this.scope.config.payloadData.fields.token]: token,
     });

package/vona/src/suite-vendor/a-vona/modules/a-user/src/service/redisToken.ts

@@ -47,11 +47,15 @@ export class ServiceRedisToken extends BeanBase {
 
   private _getAuthRedisKey(payloadData: IPayloadData) {
     if (!this.ctx.instance) return;
-    return `${this._getUserId(payloadData)}:${this._getAuthId(payloadData)}`;
+    const key = `${this._getUserId(payloadData)}:${this._getAuthId(payloadData)}`;
+    if (this.bean.passport.authTokenMode === 'auth') return key;
+    const token = this._getToken(payloadData);
+    if (!token) return;
+    return `${key}:${token}`;
   }
 
   private _getAuthRedisKeyPrefix(user: IUser) {
-    return `${user.id}`;
+    return `${user.id}:`;
   }
 
   private _getToken(payloadData: IPayloadData) {

package/vona/src/suite-vendor/a-vona/modules/a-user/src/types/auth.ts

@@ -21,8 +21,10 @@ export interface IAuth {
 }
 
 export type TypeAuthTokenStrategy = 'reissue' | 'refresh' | 'reuse';
+export type TypeAuthTokenMode = 'auth' | 'session';
 
 export interface IAuthTokenConfig {
+  mode: TypeAuthTokenMode;
   stateless: boolean;
   strategy: {
     refreshAuthToken: TypeAuthTokenStrategy;
@@ -60,3 +62,9 @@ export interface IAuthTokenOptions {
 export interface ISigninOptions {
   authToken?: IAuthTokenOptions;
 }
+
+declare module 'vona' {
+  export interface VonaConfigEnv {
+    AUTH_TOKEN_MODE: string | undefined;
+  }
+}

package/vona/src/suite-vendor/a-vona/modules/a-user/src/types/passport.ts

@@ -20,6 +20,7 @@ export interface IPassportAdapter {
 declare module 'vona' {
   export interface ContextState {
     passport?: IPassport;
+    passportPayloadData?: IPayloadData;
   }
 
   export interface VonaContext {

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.112",
+  "version": "5.1.114",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/src/suite/a-home/modules/home-layoutadmin/src/component/layoutAdmin/render.user.tsx

@@ -1,5 +1,6 @@
 import { BeanRenderBase } from 'zova';
 import { Render } from 'zova-module-a-bean';
+import { ZButton } from 'zova-module-basic-button';
 import { resolveImagePreviewUrl } from 'zova-module-basic-image';
 import { closeNearestDetails } from 'zova-module-home-base';
 
@@ -32,14 +33,14 @@ export class RenderUser extends BeanRenderBase {
               </a>
             </li>
             <li>
-              <a
-                onClick={event => {
-                  this.$passport.logout().mutate();
+              <ZButton
+                onPerform={async event => {
                   closeNearestDetails(event);
+                  await this.$passport.logout().mutateAsync();
                 }}
               >
                 {this.scope.locale.Logout()}
-              </a>
+              </ZButton>
             </li>
           </ul>
         </details>

package/zova/src/suite/a-home/modules/home-layoutweb/src/component/layoutWeb/render.user.tsx

@@ -1,5 +1,6 @@
 import { BeanRenderBase, ClientOnly } from 'zova';
 import { Render } from 'zova-module-a-bean';
+import { ZButton } from 'zova-module-basic-button';
 import { resolveImagePreviewUrl } from 'zova-module-basic-image';
 import { closeNearestDetails } from 'zova-module-home-base';
 
@@ -39,14 +40,14 @@ export class RenderUser extends BeanRenderBase {
                     </a>
                   </li>
                   <li>
-                    <a
-                      onClick={event => {
-                        this.$passport.logout().mutate();
+                    <ZButton
+                      onPerform={async event => {
                         closeNearestDetails(event);
+                        await this.$passport.logout().mutateAsync();
                       }}
                     >
                       {this.scope.locale.Logout()}
-                    </a>
+                    </ZButton>
                   </li>
                 </>
               ) : (