propro-utils 1.7.54 → 1.7.56

package/middlewares/accessTokenContract.test.js

@@ -0,0 +1,219 @@
+/**
+ * Contract tests for `authValidation` in propro-utils.
+ *
+ * This middleware guards every /api route. Three things about it are wrong in
+ * ways that reach users as the wrong behaviour rather than a clear error:
+ *
+ *  - It answers 403 for an expired or missing access token. The client's axios
+ *    interceptor keys its refresh-and-retry on 401 alone, so a request that
+ *    should have transparently refreshed instead fails permanently. It only
+ *    works today because ~15 call sites hand-roll a checkAccessToken() before
+ *    every request; anything that forgets is dead in the water.
+ *
+ *  - Its catch block calls next() twice when the auth service returns an HTTP
+ *    error (there is no `return` on the first), producing ERR_HTTP_HEADERS_SENT,
+ *    and the app's error handler hardcodes 500 — so "log in again" and "the
+ *    auth service is down" are indistinguishable to the client.
+ *
+ *  - It caches permissions under the raw access token for 30 minutes with no
+ *    invalidation, so a revoked token keeps working for up to half an hour.
+ */
+// jest.mock must precede the requires: this package does not hoist mock
+// registrations above CommonJS require() calls, and access_token.js
+// destructures checkIfUserExists at module load.
+// EVERY jest.mock has to sit above EVERY require, not just above the module
+// under test: access_token.js pulls in axios and account_info at load, so a
+// registration made after the first require is too late for all of them.
+jest.mock('axios');
+jest.mock('./account_info', () => ({
+  checkIfUserExists: jest.fn(async () => ({ id: 'user-1' })),
+  getAccountProfile: jest.fn(),
+  updateUserGlobalStyleShortcuts: jest.fn(),
+}));
+
+const authValidation = require('./access_token');
+const axios = require('axios');
+const { checkIfUserExists } = require('./account_info');
+const ServiceManager = require('../utils/serviceManager');
+
+/** Minimal redis double with a real in-memory map, so TTLs are observable. */
+function makeRedis() {
+  const entries = new Map();
+  return {
+    entries,
+    get: jest.fn(async key => entries.get(key)?.value ?? null),
+    setEx: jest.fn(async (key, ttl, value) => {
+      entries.set(key, { value, ttl });
+    }),
+  };
+}
+
+function makeRes() {
+  const res = {
+    statusCode: 200,
+    json: jest.fn(() => res),
+    status: jest.fn(code => {
+      res.statusCode = code;
+      return res;
+    }),
+  };
+  return res;
+}
+
+const withToken = token => ({
+  cookies: {},
+  headers: { authorization: `Bearer ${token}` },
+});
+
+let redis;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  redis = makeRedis();
+  jest.spyOn(ServiceManager, 'getService').mockResolvedValue(redis);
+  checkIfUserExists.mockResolvedValue({ id: 'user-1' });
+  // authValidation keeps module-level in-process caches (5s TTL) in front of
+  // redis. Without this, a hit from a previous test satisfies the next one and
+  // the redis assertions below silently pass for the wrong reason.
+  authValidation.clearMemoryCaches();
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe('authValidation status codes', () => {
+  it('answers 401 when no access token is presented', async () => {
+    const res = makeRes();
+
+    await authValidation(['user'])(
+      { cookies: {}, headers: {} },
+      res,
+      jest.fn()
+    );
+
+    // 403 here means "authenticated but forbidden", which tells the client not
+    // to bother refreshing. Missing credentials is 401.
+    expect(res.status).toHaveBeenCalledWith(401);
+  });
+
+  it('answers 401 when the auth service rejects the token', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: null, validPermissions: false },
+    });
+    const res = makeRes();
+
+    await authValidation(['user'])(withToken('expired'), res, jest.fn());
+
+    expect(res.status).toHaveBeenCalledWith(401);
+  });
+
+  it('answers 403 only when the account genuinely lacks the permission', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: 'acct-1', validPermissions: false, authenticated: true },
+    });
+    const res = makeRes();
+
+    await authValidation(['admin'])(withToken('valid'), res, jest.fn());
+
+    expect(res.status).toHaveBeenCalledWith(403);
+  });
+
+  it('passes a valid token through with account and user attached', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: 'acct-1', validPermissions: true },
+    });
+    const req = withToken('valid');
+    const next = jest.fn();
+
+    await authValidation(['user'])(req, makeRes(), next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(next).toHaveBeenCalledWith();
+    expect(req.account).toBe('acct-1');
+    expect(req.user).toBe('user-1');
+  });
+});
+
+describe('authValidation error handling', () => {
+  it('calls next exactly once when the auth service errors', async () => {
+    axios.post.mockRejectedValue({
+      response: { status: 502, data: { message: 'upstream exploded' } },
+    });
+    const next = jest.fn();
+
+    await authValidation(['user'])(withToken('valid'), makeRes(), next);
+
+    // Twice means ERR_HTTP_HEADERS_SENT and a misleading 500.
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('calls next exactly once when the auth service is unreachable', async () => {
+    axios.post.mockRejectedValue(new Error('ECONNREFUSED'));
+    const next = jest.fn();
+
+    await authValidation(['user'])(withToken('valid'), makeRes(), next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('authValidation permission cache', () => {
+  it('does not put the raw access token in the cache key', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: 'acct-1', validPermissions: true },
+    });
+
+    await authValidation(['user'])(withToken('super-secret-token'), makeRes(), jest.fn());
+
+    const keys = [...redis.entries.keys()];
+    expect(keys.length).toBeGreaterThan(0);
+    for (const key of keys) {
+      // A live bearer token sitting in redis under a predictable key is a
+      // credential at rest for no reason — hash it.
+      expect(key).not.toContain('super-secret-token');
+    }
+  });
+
+  it('caches a successful validation for less than the access token lifetime', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: 'acct-1', validPermissions: true },
+    });
+
+    await authValidation(['user'])(withToken('valid'), makeRes(), jest.fn());
+
+    const [entry] = [...redis.entries.values()];
+    // 1800s outlived the token it described, so a revoked or expired token kept
+    // working for up to half an hour.
+    expect(entry.ttl).toBeLessThanOrEqual(300);
+  });
+
+  it('never caches a failed validation', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: 'acct-1', validPermissions: false, authenticated: true },
+    });
+
+    await authValidation(['admin'])(withToken('valid'), makeRes(), jest.fn());
+
+    // Caching a negative locked the account out for the full TTL even after
+    // the permission was granted.
+    expect(redis.entries.size).toBe(0);
+  });
+
+  it('separates cache entries by required permission', async () => {
+    axios.post.mockResolvedValue({
+      data: { accountId: 'acct-1', validPermissions: true },
+    });
+
+    await authValidation(['user'])(withToken('valid'), makeRes(), jest.fn());
+    await authValidation(['admin'])(withToken('valid'), makeRes(), jest.fn());
+
+    // One key for both would let a 'user' check satisfy an 'admin' route.
+    // Count only the permission keys — a successful pass also writes an
+    // `account:user:*` entry, which is a different cache.
+    const permissionKeys = [...redis.entries.keys()].filter(key =>
+      key.startsWith('account:permissions:')
+    );
+    expect(permissionKeys).toHaveLength(2);
+  });
+});

package/middlewares/access_token.js

@@ -36,8 +36,20 @@ const ServiceManager = require('../utils/serviceManager');
  * });
  */
 const USER_CACHE_TTL_SECONDS = 60;
+/**
+ * How long a successful token validation may be trusted without re-asking the
+ * auth service.
+ *
+ * This is a revocation window, not a performance knob: for its duration a
+ * revoked or logged-out token still passes. It was 1800s, which outlives the
+ * access tokens it describes — so signing out left a token working for up to
+ * half an hour. Five minutes keeps most of the load saving while bounding the
+ * window to something defensible.
+ */
+const AUTH_VALIDATION_CACHE_TTL_SECONDS = 300;
 const IN_PROCESS_AUTH_CACHE_TTL_MS = 5000;
 const MAX_IN_PROCESS_CACHE_ENTRIES = 1000;
+const AUTH_SERVICE_TIMEOUT_MS = 10000;
 const validationMemoryCache = new Map();
 const userMemoryCache = new Map();
 
@@ -77,7 +89,12 @@ const authValidation = (requiredPermissions = []) => {
       req.headers.authorization?.split(' ')[1];
       
       if (!accessToken) {
-        return res.status(403).json({ error: 'Access token is required' });
+        // 401, not 403. Clients read 403 as "authenticated but forbidden" and
+        // do not attempt a refresh — an axios interceptor keys retry-after-
+        // refresh on 401 alone. Answering 403 to a missing credential turns a
+        // recoverable expiry into a permanent failure, and is why callers had
+        // to hand-roll a token check before every request.
+        return res.status(401).json({ error: 'Access token is required' });
       }
       
       const fetchPermission = async () => {
@@ -86,7 +103,8 @@ const authValidation = (requiredPermissions = []) => {
           {
             accessToken: accessToken,
             requiredPermissions: requiredPermissions,
-          }
+          },
+          { timeout: AUTH_SERVICE_TIMEOUT_MS }
         );
         return response.data;
       };
@@ -100,12 +118,28 @@ const authValidation = (requiredPermissions = []) => {
           redisClient,
           validationCacheKey,
           fetchPermission,
-          1800
+          AUTH_VALIDATION_CACHE_TTL_SECONDS,
+          // Positives only. Caching a denial keeps refusing a request that has
+          // since been granted, for the whole TTL — a permission change would
+          // appear not to have taken effect.
+          result => Boolean(result?.validPermissions)
         );
-      setInMemoryCache(validationMemoryCache, validationCacheKey, validationResult);
+      if (validationResult?.validPermissions) {
+        setInMemoryCache(validationMemoryCache, validationCacheKey, validationResult);
+      }
       const { accountId, validPermissions } = validationResult;
-      
+
       if (!validPermissions) {
+        // Distinguish "we don't know who you are" from "we know, and no".
+        // Without an accountId the auth service rejected the token itself, so
+        // the client should refresh and retry — which it only does on 401. A
+        // resolved account that lacks the permission is a genuine 403, and
+        // refreshing would not help.
+        if (!accountId) {
+          return res
+            .status(401)
+            .json({ error: 'Invalid or expired access token' });
+        }
         return res.status(403).json({ error: 'Invalid permissions' });
       }
       
@@ -135,6 +169,15 @@ const authValidation = (requiredPermissions = []) => {
       if (error.response && error.response.status) {
         return next(new Error(error.response.data.message));
       }
+      if (error.code === 'ECONNABORTED') {
+        console.error(`[auth] Auth service timed out after ${AUTH_SERVICE_TIMEOUT_MS}ms: ${process.env.AUTH_URL}`);
+        return next(new Error('Auth service timeout'));
+      }
+      if (error.code) {
+        console.error(`[auth] Auth service unreachable (${error.code}): ${process.env.AUTH_URL}`, error.message);
+        return next(new Error('Auth service unreachable'));
+      }
+      console.error('[auth] Unexpected error during token validation:', error);
       return next(new Error('Error validating token'));
     }
   };

package/middlewares/access_token.test.js

@@ -43,12 +43,15 @@ describe('authValidation middleware', () => {
     axios.post.mockReset();
   });
 
-  it('returns 403 if access token is missing', async () => {
+  // Was asserting 403. A missing credential is 401: clients read 403 as
+  // "authenticated but forbidden" and do not attempt a refresh, so answering
+  // 403 turned a recoverable expiry into a permanent failure.
+  it('returns 401 if access token is missing', async () => {
     const middleware = authValidation(['user']);
 
     await middleware(req, res, next);
 
-    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.status).toHaveBeenCalledWith(401);
     expect(res.json).toHaveBeenCalledWith({ error: 'Access token is required' });
     expect(ServiceManager.getService).not.toHaveBeenCalled();
     expect(getOrSetCache).not.toHaveBeenCalled();
@@ -65,12 +68,16 @@ describe('authValidation middleware', () => {
     await middleware(req, res, next);
 
     expect(ServiceManager.getService).toHaveBeenCalledWith('RedisClient');
+    // TTL was 1800, which outlived the access tokens it described — a revoked
+    // token kept passing for up to half an hour. The trailing predicate keeps
+    // denials out of the cache, so a permission grant takes effect at once.
     expect(getOrSetCache).toHaveBeenNthCalledWith(
       1,
       redisClient,
       'account:permissions:3f08aace122ee2368432c1ca23a049bc640bafbf00fdf33a52429f38ba12dbf9:user',
       expect.any(Function),
-      1800
+      300,
+      expect.any(Function)
     );
     expect(getOrSetCache).toHaveBeenNthCalledWith(
       2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.7.54",
+  "version": "1.7.56",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "private": false,

package/src/server/index.js

@@ -196,83 +196,62 @@ class AuthMiddleware {
       });
     }
 
-    // Prevent concurrent refresh requests for the same token
+    // De-duplicate concurrent refreshes of the same token.
+    //
+    // The shared promise resolves to the rotated token DATA only. It used to
+    // resolve to a finished response body built inside the first request's
+    // closure, which meant a waiter was answered with someone else's response:
+    // `setAuthCookies` wrote to the first `res`, and `req.query.returnTokens`
+    // read the first `req`. A web waiter therefore got 200 with no Set-Cookie,
+    // and a desktop waiter queued behind a web caller got no tokens at all —
+    // both of which read downstream as a failed session and send the user back
+    // to sign-in. Every caller now renders its own response from its own
+    // req/res below.
     const lockKey = refreshToken;
-    if (this.refreshLocks.has(lockKey)) {
-      // Wait for the in-flight request to complete
+    let refreshPromise = this.refreshLocks.get(lockKey);
+    const reusedInFlight = Boolean(refreshPromise);
+
+    if (!refreshPromise) {
+      refreshPromise = this.performTokenRefresh(refreshToken);
+      this.refreshLocks.set(lockKey, refreshPromise);
+
+      // Release as soon as it settles, success or failure. Holding a spent
+      // token's lock for 30s after success meant a later, unrelated request
+      // was answered from a stale cache instead of performing a real refresh.
+      const release = () => {
+        if (this.refreshLocks.get(lockKey) === refreshPromise) {
+          this.refreshLocks.delete(lockKey);
+        }
+      };
+      refreshPromise.then(release, release);
+    } else {
       console.log('Waiting for in-flight refresh request to complete...');
-      try {
-        const result = await this.refreshLocks.get(lockKey);
-        console.log('Reusing result from in-flight refresh request');
-        return res.status(200).json(result);
-      } catch (error) {
-        console.error('In-flight refresh request failed:', error);
-        return res.status(401).json({ 
-          error: 'Failed to refresh token',
-          message: 'Session refresh failed. Please log in again.',
-        });
-      }
     }
 
-    // Create a promise for this refresh operation
-    const refreshPromise = (async () => {
-      console.log('Starting refresh token operation...');
-      const startTime = Date.now();
-      
-      try {
-        const response = await this.refreshTokens(refreshToken);
-        const { account, access, refresh } = response.data;
-
-        if (!account || !access || !refresh) {
-          throw new Error('Invalid or expired refresh token');
-        }
-
-        console.log(`Token refresh successful for account: ${account.accountId}`);
-
-        const user = await checkIfUserExists(account.accountId);
+    try {
+      const { account, user, access, refresh } = await refreshPromise;
 
-        const { returnTokens } = req.query;
-        if (returnTokens === 'true') {
-          console.log(`Refresh completed in ${Date.now() - startTime}ms (returning tokens)`);
-          return { account, user, access, refresh };
-        }
-        
-        setAuthCookies(
-          res,
-          { access, refresh },
-          account,
-          user,
-          this.options.appUrl
-        );
+      if (reusedInFlight) {
+        console.log('Reusing tokens from in-flight refresh request');
+      }
 
-        console.log(`Refresh completed in ${Date.now() - startTime}ms (cookies set)`);
-        return { 
-          message: 'Token refreshed successfully',
-          account: { accountId: account.accountId, email: account.email },
-        };
-      } catch (error) {
-        const status = error?.response?.status;
-        console.error(`Token refresh failed after ${Date.now() - startTime}ms (status: ${status}):`, error.message);
-        
-        // Immediately clean up lock on failure to prevent blocking
-        this.refreshLocks.delete(lockKey);
-        
-        throw error;
-      } finally {
-        // Clean up lock after 30 seconds for successful requests
-        setTimeout(() => {
-          this.refreshLocks.delete(lockKey);
-          console.log('Refresh lock cleaned up (delayed)');
-        }, 30000);
+      const { returnTokens } = req.query;
+      if (returnTokens === 'true') {
+        return res.status(200).json({ account, user, access, refresh });
       }
-    })();
 
-    // Store the promise so concurrent requests can await it
-    this.refreshLocks.set(lockKey, refreshPromise);
+      await setAuthCookies(
+        res,
+        { access, refresh },
+        account,
+        user,
+        this.options.appUrl
+      );
 
-    try {
-      const result = await refreshPromise;
-      res.status(200).json(result);
+      return res.status(200).json({
+        message: 'Token refreshed successfully',
+        account: { accountId: account.accountId, email: account.email },
+      });
     } catch (error) {
       console.error('Error refreshing token:', error);
       
@@ -300,17 +279,60 @@ class AuthMiddleware {
     }
   };
 
+  /**
+   * Performs one upstream token refresh and returns the rotated material.
+   *
+   * Deliberately free of req/res: this is the value shared between concurrent
+   * callers, so it must not close over any single request's context.
+   *
+   * @param {string} refreshToken
+   * @return {Promise<{account: object, user: object, access: object, refresh: object}>}
+   */
+  performTokenRefresh = async refreshToken => {
+    const startTime = Date.now();
+
+    try {
+      const response = await this.refreshTokens(refreshToken);
+      const { account, access, refresh } = response.data;
+
+      if (!account || !access || !refresh) {
+        throw new Error('Invalid or expired refresh token');
+      }
+
+      const user = await checkIfUserExists(account.accountId);
+
+      console.log(
+        `Token refresh successful for account ${account.accountId} in ${
+          Date.now() - startTime
+        }ms`
+      );
+
+      return { account, user, access, refresh };
+    } catch (error) {
+      console.error(
+        `Token refresh failed after ${Date.now() - startTime}ms (status: ${
+          error?.response?.status
+        }):`,
+        error.message
+      );
+      throw error;
+    }
+  };
+
   handleLogout = async (req, res) => {
     const refreshToken =
       req.cookies['x-refresh-token'] || req.headers['x-refresh-token'];
     if (!refreshToken) {
-      clearAuthCookies(res);
+      // appUrl is required: without it the deletions go out host-only and do
+      // not match the cookies setAuthCookies wrote on `.mapmap.app`, so the
+      // session survives the logout that was meant to end it.
+      await clearAuthCookies(res, this.options.appUrl);
       return this.handleAuth(req, res);
     }
 
     try {
       await this.logoutUser(refreshToken);
-      clearAuthCookies(res);
+      await clearAuthCookies(res, this.options.appUrl);
       return this.handleAuth(req, res);
       // this.res.status(200).json({ redirectUrl: this.constructRedirectUrl() });
     } catch (error) {
@@ -439,7 +461,16 @@ class AuthMiddleware {
   proxyToAuthServer = async (req, path) => {
     let accessToken = null;
     if (this.pathRequiresAccessToken(path)) {
-      accessToken = req.cookies['x-access-token'];
+      // Accept the bearer header as well as the cookie, matching what
+      // authValidation and handleRefreshToken already do. Cookie-only made
+      // every route through here unusable from a native client: Tauri has no
+      // cookie jar for the API origin and sends Authorization, so profile,
+      // password, email, 2FA and avatar updates all threw 'No access token
+      // provided' — which handleProxyError, seeing no error.response, reported
+      // as a 500.
+      accessToken =
+        req.cookies?.['x-access-token'] ||
+        req.headers?.authorization?.split(' ')[1];
       if (!accessToken) {
         throw new Error('No access token provided');
       }

package/src/server/logoutCookies.test.js

@@ -0,0 +1,157 @@
+/**
+ * Contract tests for auth cookie lifecycle in propro-utils.
+ *
+ * The defect under test — `setAuthCookies` derives a cookie domain from
+ * `appUrl` (`https://app.mapmap.app` widens to `.mapmap.app` so the API and app
+ * subdomains share a session). `handleLogout` then calls `clearAuthCookies(res)`
+ * with no `appUrl` at all, so it emits host-only deletions.
+ *
+ * A `Set-Cookie` deletion only removes a cookie whose domain attribute matches,
+ * so nothing is cleared: `x-access-token`, `x-refresh-token`, `user`, `account`
+ * and `has_account_token` all survive the logout that was supposed to remove
+ * them. Because the client's `isUserLoggedIn()` is just "is there an `account`
+ * cookie", the user is redirected to sign-in and immediately bounced back in.
+ *
+ * The invariant these tests pin down: whatever domain a cookie is written with,
+ * logout must clear it with the same one.
+ */
+// jest.mock must precede the requires below: this package's jest setup does
+// not hoist mock registrations above CommonJS require() calls, and
+// src/server/index.js destructures checkIfUserExists at module load — so a
+// mock registered afterwards is captured too late and the real one runs.
+jest.mock('../../middlewares/account_info', () => ({
+  checkIfUserExists: jest.fn(async () => ({ id: 'user-1', accountId: 'acct-1' })),
+  getAccountProfile: jest.fn(),
+  updateUserGlobalStyleShortcuts: jest.fn(),
+}));
+
+const AuthMiddleware = require('./index');
+const {
+  setAuthCookies,
+  clearAuthCookies,
+} = require('./middleware/cookieUtils');
+
+
+const APP_URL = 'https://app.mapmap.app';
+
+const OPTIONS = {
+  authUrl: 'https://auth.example.test',
+  clientId: 'client-id',
+  clientSecret: 'client-secret',
+  clientUrl: 'https://app.example.test',
+  redirectUri: 'https://app.example.test/api/callback',
+  appName: 'MapMap',
+  appUrl: APP_URL,
+};
+
+const SESSION_COOKIES = [
+  'x-refresh-token',
+  'x-access-token',
+  'user',
+  'account',
+  'has_account_token',
+];
+
+function makeRes() {
+  const res = {
+    cookie: jest.fn(),
+    clearCookie: jest.fn(),
+    redirect: jest.fn(),
+    json: jest.fn(() => res),
+    send: jest.fn(() => res),
+    status: jest.fn(() => res),
+  };
+  return res;
+}
+
+const TOKENS = {
+  access: { token: 'access-1', expires: new Date(Date.now() + 9e5) },
+  refresh: { token: 'refresh-1', expires: new Date(Date.now() + 9e6) },
+};
+
+/** name -> domain the cookie was written/cleared with. */
+function domainsFrom(calls) {
+  return calls.reduce((acc, call) => {
+    const [name, ...rest] = call;
+    const options = rest[rest.length - 1] || {};
+    acc[name] = options.domain;
+    return acc;
+  }, {});
+}
+
+describe('auth cookie lifecycle', () => {
+  it('clears every cookie on the domain it was set with', async () => {
+    const setRes = makeRes();
+    await setAuthCookies(
+      setRes,
+      TOKENS,
+      { accountId: 'acct-1' },
+      { id: 'user-1' },
+      APP_URL
+    );
+
+    const clearRes = makeRes();
+    await clearAuthCookies(clearRes, APP_URL);
+
+    const written = domainsFrom(setRes.cookie.mock.calls);
+    const cleared = domainsFrom(clearRes.clearCookie.mock.calls);
+
+    for (const name of SESSION_COOKIES) {
+      expect(cleared[name]).toBe(written[name]);
+    }
+  });
+
+  it('clears the session cookies when logging out with a refresh token', async () => {
+    const middleware = new AuthMiddleware(OPTIONS, {}, {}, {}, {});
+    middleware.logoutUser = jest.fn(async () => ({ data: {} }));
+
+    const setRes = makeRes();
+    await setAuthCookies(
+      setRes,
+      TOKENS,
+      { accountId: 'acct-1' },
+      { id: 'user-1' },
+      APP_URL
+    );
+    const written = domainsFrom(setRes.cookie.mock.calls);
+
+    const res = makeRes();
+    await middleware.handleLogout(
+      { cookies: { 'x-refresh-token': 'refresh-1' }, headers: {}, query: {} },
+      res
+    );
+
+    const cleared = domainsFrom(res.clearCookie.mock.calls);
+
+    expect(Object.keys(cleared).sort()).toEqual([...SESSION_COOKIES].sort());
+    for (const name of SESSION_COOKIES) {
+      expect(cleared[name]).toBe(written[name]);
+    }
+  });
+
+  it('revokes the refresh token upstream on logout', async () => {
+    const middleware = new AuthMiddleware(OPTIONS, {}, {}, {}, {});
+    middleware.logoutUser = jest.fn(async () => ({ data: {} }));
+
+    await middleware.handleLogout(
+      { cookies: { 'x-refresh-token': 'refresh-1' }, headers: {}, query: {} },
+      makeRes()
+    );
+
+    expect(middleware.logoutUser).toHaveBeenCalledWith('refresh-1');
+  });
+
+  it('accepts the refresh token from a header for desktop clients', async () => {
+    const middleware = new AuthMiddleware(OPTIONS, {}, {}, {}, {});
+    middleware.logoutUser = jest.fn(async () => ({ data: {} }));
+
+    // Tauri has no cookie jar for the API origin, so it sends the token as a
+    // header — the same way handleRefreshToken already accepts it.
+    await middleware.handleLogout(
+      { cookies: {}, headers: { 'x-refresh-token': 'refresh-1' }, query: {} },
+      makeRes()
+    );
+
+    expect(middleware.logoutUser).toHaveBeenCalledWith('refresh-1');
+  });
+});

package/src/server/middleware/cookieUtils.js

@@ -78,6 +78,39 @@ const setChromeExtensionCookie = details => {
   });
 };
 
+/**
+ * Resolves the cookie domain for an appUrl.
+ *
+ * Shared by set and clear on purpose. A `Set-Cookie` deletion only removes a
+ * cookie whose domain attribute matches, so if these two ever compute the
+ * domain differently, logout silently leaves the session cookies in place —
+ * which is exactly what happened: cookies were written on `.mapmap.app` and
+ * cleared host-only, so `x-access-token`, `x-refresh-token`, `user`, `account`
+ * and `has_account_token` all survived, and the client (whose `isUserLoggedIn`
+ * is just "is there an account cookie") bounced straight back in.
+ *
+ * @param {string|undefined} appUrl
+ * @return {string|undefined} Cookie domain, or undefined for host-only.
+ */
+const resolveCookieDomain = appUrl => {
+  try {
+    let domain = appUrl ? new URL(appUrl).hostname : undefined;
+    if (domain?.includes('mapmap.app')) {
+      domain = '.mapmap.app';
+    }
+    if (domain?.includes('localhost')) {
+      domain = undefined;
+    }
+    if (domain?.includes('propro.so')) {
+      domain = 'propro.so';
+    }
+    return domain;
+  } catch (error) {
+    console.error('Invalid appUrl:', { error, appUrl });
+    return undefined;
+  }
+};
+
 /**
  * Sets cookies for both web and extension contexts
  */
@@ -98,23 +131,7 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
   const accessMaxAge =
     new Date(tokens.access.expires).getTime() - currentDateTime.getTime();
 
-  // Domain configuration
-  let domain;
-  try {
-    domain = appUrl ? new URL(appUrl).hostname : undefined;
-    if (domain?.includes('mapmap.app')) {
-      domain = '.mapmap.app';
-    }
-    if (domain?.includes('localhost')) {
-      domain = undefined;
-    }
-    if (domain?.includes('propro.so')) {
-      domain = 'propro.so';
-    }
-  } catch (error) {
-    console.error('Invalid appUrl:', { error, appUrl });
-    domain = undefined;
-  }
+  const domain = resolveCookieDomain(appUrl);
 
   const commonAttributes = {
     secure: true,
@@ -205,19 +222,10 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
  * Clears cookies from both web and extension contexts
  */
 const clearAuthCookies = async (res, appUrl) => {
-  let domain;
-  try {
-    domain = appUrl ? new URL(appUrl).hostname : undefined;
-    if (domain?.includes('mapmap.app')) {
-      domain = '.mapmap.app';
-    }
-    if (domain?.includes('localhost')) {
-      domain = undefined;
-    }
-  } catch (error) {
-    console.error('Invalid appUrl:', error);
-    domain = undefined;
-  }
+  // Must match setAuthCookies exactly — see resolveCookieDomain. This used to
+  // omit the propro.so branch as well as being called without an appUrl at all,
+  // so it could miss on two counts.
+  const domain = resolveCookieDomain(appUrl);
 
   const commonAttributes = {
     secure: true,
@@ -268,4 +276,5 @@ const clearAuthCookies = async (res, appUrl) => {
 module.exports = {
   setAuthCookies,
   clearAuthCookies,
+  resolveCookieDomain,
 };

package/src/server/refreshConcurrency.test.js

@@ -0,0 +1,163 @@
+/**
+ * Contract tests for `AuthMiddleware.handleRefreshToken` in propro-utils.
+ *
+ * These test a dependency rather than our own source, deliberately: the
+ * behaviour is ours to rely on, the package is ProPro-owned, and the fix ships
+ * as a pnpm patch (see patches/). A contract test is the only thing that tells
+ * us the patch is still applied after a version bump.
+ *
+ * The defect under test — `handleRefreshToken` de-duplicates concurrent
+ * refreshes by caching the in-flight promise under the refresh token, then
+ * replies to every waiter with `res.status(200).json(result)`. But `result` is
+ * built inside the *first* request's closure: `setAuthCookies(res, ...)` writes
+ * to the first `res`, and `req.query.returnTokens` reads the first `req`. So a
+ * waiter gets an HTTP 200 carrying neither its cookies nor its tokens.
+ *
+ * Downstream that is an auth loop. The waiter still holds an expired access
+ * token, its next call 401s, the interceptor exhausts its single retry and
+ * redirects to sign-in — on desktop, `checkAccessToken` throws
+ * "Invalid refresh response", clears the session and opens another browser
+ * window.
+ */
+// jest.mock must precede the requires below: this package's jest setup does
+// not hoist mock registrations above CommonJS require() calls, and
+// src/server/index.js destructures checkIfUserExists at module load — so a
+// mock registered afterwards is captured too late and the real one runs.
+jest.mock('../../middlewares/account_info', () => ({
+  checkIfUserExists: jest.fn(async () => ({ id: 'user-1', accountId: 'acct-1' })),
+  getAccountProfile: jest.fn(),
+  updateUserGlobalStyleShortcuts: jest.fn(),
+}));
+
+const AuthMiddleware = require('./index');
+
+
+const OPTIONS = {
+  authUrl: 'https://auth.example.test',
+  clientId: 'client-id',
+  clientSecret: 'client-secret',
+  clientUrl: 'https://app.example.test',
+  redirectUri: 'https://app.example.test/api/callback',
+  appName: 'MapMap',
+  appUrl: 'https://app.mapmap.app',
+};
+
+const REFRESH_TOKEN = 'refresh-token-abc';
+
+function makeRes() {
+  const res = {
+    cookie: jest.fn(),
+    clearCookie: jest.fn(),
+    redirect: jest.fn(),
+    json: jest.fn(() => res),
+    send: jest.fn(() => res),
+    status: jest.fn(() => res),
+  };
+  return res;
+}
+
+function makeReq({ returnTokens } = {}) {
+  return {
+    cookies: { 'x-refresh-token': REFRESH_TOKEN },
+    headers: {},
+    query: returnTokens ? { returnTokens: 'true' } : {},
+  };
+}
+
+/** Freshly built each test so the instance-level refreshLocks map is clean. */
+function buildMiddleware() {
+  const middleware = new AuthMiddleware(OPTIONS, {}, {}, {}, {});
+
+  // Stub the upstream call so no network is involved and rotation is visible.
+  middleware.refreshTokens = jest.fn(async () => ({
+    data: {
+      account: { accountId: 'acct-1', email: 'user@example.test' },
+      access: { token: 'new-access', expires: new Date(Date.now() + 9e5) },
+      refresh: { token: 'new-refresh', expires: new Date(Date.now() + 9e6) },
+    },
+  }));
+
+  return middleware;
+}
+
+/** The payload a caller actually received, whatever shape it took. */
+function payloadOf(res) {
+  expect(res.json).toHaveBeenCalled();
+  return res.json.mock.calls[res.json.mock.calls.length - 1][0];
+}
+
+describe('handleRefreshToken — concurrent refresh', () => {
+  it('gives every concurrent desktop caller the rotated tokens', async () => {
+    const middleware = buildMiddleware();
+    const resA = makeRes();
+    const resB = makeRes();
+
+    await Promise.all([
+      middleware.handleRefreshToken(makeReq({ returnTokens: true }), resA),
+      middleware.handleRefreshToken(makeReq({ returnTokens: true }), resB),
+    ]);
+
+    // One upstream refresh is the point of the lock — that part works.
+    expect(middleware.refreshTokens).toHaveBeenCalledTimes(1);
+
+    for (const res of [resA, resB]) {
+      const body = payloadOf(res);
+      expect(body.access && body.access.token).toBe('new-access');
+      expect(body.refresh && body.refresh.token).toBe('new-refresh');
+    }
+  });
+
+  it('sets cookies on every concurrent web caller, not just the first', async () => {
+    const middleware = buildMiddleware();
+    const resA = makeRes();
+    const resB = makeRes();
+
+    await Promise.all([
+      middleware.handleRefreshToken(makeReq(), resA),
+      middleware.handleRefreshToken(makeReq(), resB),
+    ]);
+
+    for (const res of [resA, resB]) {
+      const names = res.cookie.mock.calls.map(([name]) => name);
+      expect(names).toEqual(expect.arrayContaining(['x-access-token']));
+    }
+  });
+
+  it('honours each caller’s own returnTokens, not the first caller’s', async () => {
+    const middleware = buildMiddleware();
+    const webRes = makeRes();
+    const desktopRes = makeRes();
+
+    // Web starts the refresh and owns the lock; desktop arrives while it is
+    // in flight. This mixed pairing is the everyday case for a user signed in
+    // on both, and it is where the shared-closure bug bites hardest.
+    await Promise.all([
+      middleware.handleRefreshToken(makeReq(), webRes),
+      middleware.handleRefreshToken(makeReq({ returnTokens: true }), desktopRes),
+    ]);
+
+    const desktopBody = payloadOf(desktopRes);
+    expect(desktopBody.access && desktopBody.access.token).toBe('new-access');
+  });
+
+  it('does not hold the lock after the refresh settles', async () => {
+    const middleware = buildMiddleware();
+
+    await middleware.handleRefreshToken(makeReq({ returnTokens: true }), makeRes());
+    await middleware.handleRefreshToken(makeReq({ returnTokens: true }), makeRes());
+
+    // The old token is spent the moment rotation succeeds. Holding its lock for
+    // 30s means a later caller is answered from a stale cache instead of being
+    // told to re-authenticate.
+    expect(middleware.refreshTokens).toHaveBeenCalledTimes(2);
+  });
+
+  it('rejects a request with no refresh token', async () => {
+    const middleware = buildMiddleware();
+    const res = makeRes();
+
+    await middleware.handleRefreshToken({ cookies: {}, headers: {}, query: {} }, res);
+
+    expect(res.status).toHaveBeenCalledWith(401);
+  });
+});

package/utils/redis.js

@@ -1,15 +1,34 @@
-const getOrSetCache = async (redisClient, key, service, time = 1800) => {
-  try {
-    const cachedValue = await redisClient.get(key);
-    if (cachedValue) {
-      return JSON.parse(cachedValue);
-    }
-    const value = await service();
+/**
+ * Read-through cache helper.
+ *
+ * @param {object} redisClient
+ * @param {string} key
+ * @param {Function} service Produces the value on a miss.
+ * @param {number} [time=1800] TTL in seconds.
+ * @param {Function} [shouldCache] Decides whether a freshly produced value is
+ *   worth storing. Defaults to caching everything, which is the right default
+ *   for data but the wrong one for authorization decisions: caching a "no"
+ *   keeps denying a request that has since been granted, for the full TTL.
+ *   Callers that can distinguish a negative result pass a predicate.
+ * @return {Promise<*>}
+ */
+const getOrSetCache = async (
+  redisClient,
+  key,
+  service,
+  time = 1800,
+  shouldCache = () => true
+) => {
+  const cachedValue = await redisClient.get(key);
+  if (cachedValue) {
+    return JSON.parse(cachedValue);
+  }
+
+  const value = await service();
+  if (shouldCache(value)) {
     await redisClient.setEx(key, time, JSON.stringify(value));
-    return value;
-  } catch (error) {
-    throw error;
   }
+  return value;
 };
 
 module.exports = { getOrSetCache };