tempest-react-sdk 0.84.0 → 0.86.0

package/dist/auth/create-tempest-auth.js

@@ -6,8 +6,8 @@ import { createAuthStore as i } from "./create-auth-store.js";
 import { decodeJWT as a } from "./jwt.js";
 import { createRefreshQueue as o } from "./refresh-queue.js";
 //#region src/auth/create-tempest-auth.ts
-var s = 1e4, c = 1e4;
-function l(e, t) {
+var s = 1e4, c = 1e4, l = "sign-in-pending";
+function u(e, t) {
 	return e.length === 0 ? Promise.resolve() : new Promise((n) => {
 		let r = setTimeout(n, t);
 		Promise.allSettled(e).then(() => {
@@ -15,15 +15,15 @@ function l(e, t) {
 		});
 	});
 }
-function u() {
+function d() {
 	let e = globalThis.crypto;
 	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
 }
-var d = /* @__PURE__ */ new Set();
+var f = /* @__PURE__ */ new Set();
 function ee(t) {
-	e() && !d.has(t) && (d.add(t), console.warn("[tempest-react-sdk] createTempestAuth: withCredentials is set without logoutPath. logout() cannot clear the HttpOnly refresh cookie, so the next refresh() — the boot restore — signs the same account back in. Pass logoutPath (the backend's cookie logout route) so the server revokes it."));
+	e() && !f.has(t) && (f.add(t), console.warn("[tempest-react-sdk] createTempestAuth: withCredentials is set without logoutPath. logout() cannot clear the HttpOnly refresh cookie, so the next refresh() — the boot restore — signs the same account back in. Pass logoutPath (the backend's cookie logout route) so the server revokes it."));
 }
-function f(e) {
+function te(e) {
 	if (!e) return null;
 	try {
 		let { sub: t } = a(e).payload;
@@ -32,7 +32,7 @@ function f(e) {
 		return null;
 	}
 }
-function te(e) {
+function ne(e) {
 	let t = e ?? {};
 	return {
 		token: t.access_token,
@@ -40,98 +40,106 @@ function te(e) {
 	};
 }
 function p(a) {
-	let { baseURL: d, prefix: p, loginPath: ne = "/api/auth/login", refreshPath: m = "/api/auth/refresh", logoutPath: h, onLogoutError: re, mePath: ie, storeName: g = "tempest-auth", storage: _ = "local", withCredentials: v = !1, csrf: ae, fetcher: y, parseTokens: b = te, parseUser: oe, refreshBody: x = (e) => e ? { refresh_token: e } : void 0, retry: se, redirectTo: S, onSessionEnd: ce } = a;
+	let { baseURL: f, prefix: p, loginPath: re = "/api/auth/login", refreshPath: m = "/api/auth/refresh", logoutPath: h, onLogoutError: ie, mePath: ae, storeName: g = "tempest-auth", storage: _ = "local", withCredentials: v = !1, csrf: oe, fetcher: se, parseTokens: y = ne, parseUser: ce, refreshBody: b = (e) => e ? { refresh_token: e } : void 0, retry: le, redirectTo: ue, onSessionEnd: de } = a;
 	v && !h && ee(g);
-	let C = i({
+	let x = i({
 		name: g,
 		storage: _
-	}), w = `${g}-refresh`;
-	function T() {
+	}), S = `${g}-refresh`;
+	function C() {
 		return typeof window > "u" ? null : _ === "session" ? window.sessionStorage : window.localStorage;
 	}
-	function E() {
-		return T()?.getItem(w) ?? null;
-	}
-	let D = E();
-	function O(e) {
-		D = e;
-		let t = T();
-		t && (e ? t.setItem(w, e) : t.removeItem(w));
-	}
-	let k = `${g}-lineage`, le = `tempest-react-sdk:${g}:refresh`, A = T()?.getItem(k) ?? null;
-	function j(e) {
-		A = e;
-		let t = T();
-		t && (e ? t.setItem(k, e) : t.removeItem(k));
-	}
-	let M = () => C.getState(), N = () => M().token;
-	async function ue() {
-		if (!ie) return M().user;
-		let e = P, n;
+	function w() {
+		return C()?.getItem(S) ?? null;
+	}
+	let T = w();
+	function E(e) {
+		T = e;
+		let t = C();
+		t && (e ? t.setItem(S, e) : t.removeItem(S));
+	}
+	let D = `${g}-lineage`, fe = `tempest-react-sdk:${g}:refresh`, pe = `tempest-react-sdk:${g}:sign-in`, O = C()?.getItem(D) ?? null;
+	function k(e) {
+		O = e;
+		let t = C();
+		t && (e ? t.setItem(D, e) : t.removeItem(D));
+	}
+	let A = () => x.getState(), j = () => A().token;
+	async function me() {
+		if (!ae) return A().user;
+		let e = M, n;
 		try {
-			n = await Q.get(ie, { skipAuthRetry: !0 });
+			n = await Y.get(ae, { skipAuthRetry: !0 });
 		} catch (n) {
-			throw P === e ? n : new t();
+			throw M === e ? n : new t();
 		}
-		if (P !== e || !Z().continues) throw new t();
-		return M().setUser(n), n;
+		if (M !== e || !J().continues) throw new t();
+		return A().setUser(n), n;
 	}
-	let P = 0, de = Promise.resolve(), F = 0, I = /* @__PURE__ */ new Set(), L = /* @__PURE__ */ new Set(), R = /* @__PURE__ */ new Set(), z = /* @__PURE__ */ new Set();
-	function B(e) {
+	let M = 0, he = Promise.resolve(), N = 0, P = /* @__PURE__ */ new Set(), F = 0, I = /* @__PURE__ */ new Set(), L = /* @__PURE__ */ new Set(), R = /* @__PURE__ */ new Set();
+	function z(e) {
 		let t = e.then(() => void 0, () => void 0);
-		return R.add(t), t.then(() => R.delete(t)), e;
+		return L.add(t), t.then(() => L.delete(t)), e;
 	}
-	function fe(t) {
+	function ge(t) {
 		e() && console.warn("[tempest-react-sdk] createTempestAuth: logoutPath revocation failed", t);
 		try {
-			re?.(t);
+			ie?.(t);
 		} catch {
 			return;
 		}
 	}
-	function V(e) {
+	function _e(e) {
 		let t = (async () => {
 			try {
 				await e();
 			} catch (e) {
-				fe(e);
+				ge(e);
 			}
 		})();
-		return L.add(t), t.then(() => L.delete(t)), t;
+		return I.add(t), t.then(() => I.delete(t)), t;
 	}
-	function H(e, t) {
-		h && !v && t && V(() => U(e).post(h, { body: x(t) }));
+	function B(e, t) {
+		h && !v && t && _e(() => V(e).post(h, { body: b(t) }));
 	}
-	function U(e) {
+	function V(e) {
 		return n({
-			baseURL: d,
+			baseURL: f,
 			prefix: p,
 			withCredentials: v,
-			csrf: ae,
-			fetcher: y,
+			csrf: oe,
+			fetcher: se,
 			getToken: () => e
 		});
 	}
-	function W() {
-		P += 1, q = o(G);
+	function ve() {
+		M += 1, W = o(ye);
 	}
-	async function G() {
-		let e = N(), t = P;
-		z.add(t);
-		let n;
+	async function ye() {
+		let e = j(), n = M;
+		R.add(n);
+		let r;
+		try {
+			r = await H(() => Se(e)), r === l && (await xe(), r = await H(() => Se(e)));
+		} finally {
+			R.delete(n);
+		}
+		if (r === l) throw new t();
+		if (!r) return;
+		let i = r;
 		try {
-			n = await K(() => pe(e));
+			if (M !== n || F > 0) throw B(i.token ?? null, i.refreshToken), new t();
+			await G(K(i));
 		} finally {
-			z.delete(t);
+			i.release();
 		}
-		n && await J(Y(n));
 	}
-	async function K(e) {
-		let t = _ === "local" && typeof navigator < "u" ? navigator.locks : void 0;
+	async function H(e) {
+		let t = U();
 		if (!t) return e();
 		let n = new AbortController(), r = setTimeout(() => n.abort(), c), i = !1, a;
 		try {
-			await t.request(le, { signal: n.signal }, async () => {
+			await t.request(fe, { signal: n.signal }, async () => {
 				i = !0, clearTimeout(r), a = await e();
 			});
 		} catch (t) {
@@ -140,104 +148,165 @@ function p(a) {
 		}
 		return a;
 	}
-	async function pe(e) {
-		let n = e !== null || M().user !== null || D !== null, r = Z();
-		if (!n && N() !== null) return null;
-		if (!r.continues) throw new t();
-		if (N() !== e) return null;
-		let i = P, a;
+	function U() {
+		return _ === "local" && typeof navigator < "u" ? navigator.locks : void 0;
+	}
+	async function be() {
+		let e = U();
+		if (!e) return () => void 0;
+		let t, n = new Promise((e) => {
+			t = e;
+		});
 		try {
-			a = await B(Q.post(m, {
-				body: x(E()),
-				skipAuth: !0
-			}));
-		} catch (e) {
-			throw P === i ? e : new t();
+			return await new Promise((r, i) => {
+				e.request(pe, { ifAvailable: !0 }, (e) => {
+					if (e === null) r(null);
+					else return r(t), n;
+				}).catch(i);
+			});
+		} catch {
+			return () => void 0;
+		}
+	}
+	async function xe() {
+		let e = U();
+		if (!e) return;
+		let t = new AbortController(), n = setTimeout(() => t.abort(), c);
+		await e.request(pe, { signal: t.signal }, () => void 0).catch(() => void 0), clearTimeout(n);
+	}
+	async function Se(e) {
+		let n = await be();
+		if (!n) return l;
+		let r = !1;
+		try {
+			let i = e !== null || A().user !== null || T !== null, a = J();
+			if (!i && j() !== null) return null;
+			if (!a.continues) throw new t();
+			if (j() !== e) return null;
+			let o = M, s;
+			try {
+				s = await z(Y.post(m, {
+					body: b(w()),
+					skipAuth: !0
+				}));
+			} catch (e) {
+				throw M === o ? e : new t();
+			}
+			let { token: c, refreshToken: l } = y(s);
+			if (M !== o || !J().continues) throw B(c ?? null, l), new t();
+			let u = te(e), f = te(c);
+			return u !== null && f !== null && u !== f ? (r = !0, {
+				data: s,
+				token: c,
+				refreshToken: l,
+				release: n
+			}) : (i || k(d()), A().setToken(c), l && E(l), null);
+		} finally {
+			r || n();
 		}
-		let { token: o, refreshToken: s } = b(a);
-		if (P !== i || !Z().continues) throw H(o ?? null, s), new t();
-		let c = f(e), l = f(o);
-		return c !== null && l !== null && c !== l ? {
-			data: a,
-			token: o,
-			refreshToken: s
-		} : (n || j(u()), M().setToken(o), s && O(s), null);
-	}
-	let q = o(G);
-	function me(e) {
-		let t = N();
+	}
+	let W = o(ye);
+	function Ce(e) {
+		let t = j();
 		return t === null ? !1 : e.token === null || e.token !== t;
 	}
-	function he() {
-		return N() === null && E() === null;
+	function we() {
+		return j() === null && w() === null;
 	}
-	async function ge() {
-		if (!(I.size > 0 && F === 0 && (await Promise.allSettled([...I]), N() !== null))) throw Error("anonymous 401 with no session");
+	async function Te() {
+		if (!(P.size > 0 && N === 0 && (await Promise.allSettled([...P]), j() !== null))) throw Error("anonymous 401 with no session");
 	}
-	async function _e(e) {
-		if (e.epoch !== null && e.epoch !== P) throw new t();
-		if (me(e)) {
+	async function Ee(e) {
+		if (e.epoch !== null && e.epoch !== M) throw new t();
+		if (Ce(e)) {
 			if (e.token === null) throw Error("anonymous 401 under a live session");
 			return;
 		}
-		if (e.token === null && he()) return z.has(P) ? q() : ge();
-		let n = P;
-		if (await q(), P !== n) throw new t();
+		if (e.token === null && we()) return R.has(M) ? W() : Te();
+		let n = M;
+		if (await W(), M !== n) throw new t();
 	}
-	async function ve(e, n) {
-		if (n.epoch !== null && n.epoch !== P || !Z().continues) throw new t();
-		me(n) || n.token === null && he() || await De();
+	async function De(e, n) {
+		if (n.epoch !== null && n.epoch !== M || !J().continues) throw new t();
+		Ce(n) || n.token === null && we() || await Le();
 	}
-	async function ye(e) {
-		return L.size > 0 && await l([...L], s), J(Se(e));
+	async function Oe(e) {
+		F += 1;
+		try {
+			return I.size > 0 && await u([...I], s), await G(Me(e));
+		} finally {
+			--F;
+		}
 	}
-	async function be() {
-		return L.size > 0 && await l([...L], s), J(xe());
+	async function ke() {
+		return I.size > 0 && await u([...I], s), G(Ae());
 	}
-	async function J(e) {
-		I.add(e);
+	async function G(e) {
+		P.add(e);
 		try {
 			return await e;
 		} finally {
-			I.delete(e);
+			P.delete(e);
 		}
 	}
-	async function xe() {
-		let e = P, n = await K(() => B(Q.post(m, {
-			body: x(E()),
-			skipAuth: !0
-		}))), { token: r, refreshToken: i } = b(n);
-		if (P !== e) throw H(r ?? null, i), new t();
-		return Y({
-			data: n,
-			token: r,
-			refreshToken: i
+	async function Ae() {
+		let e = M, n = await H(async () => {
+			let e = await be();
+			if (!e) return null;
+			try {
+				return {
+					data: await z(Y.post(m, {
+						body: b(w()),
+						skipAuth: !0
+					})),
+					release: e
+				};
+			} catch (t) {
+				throw e(), t;
+			}
 		});
+		if (!n) return je(e);
+		try {
+			let { token: r, refreshToken: i } = y(n.data);
+			if (M !== e) throw B(r ?? null, i), new t();
+			return await K({
+				data: n.data,
+				token: r,
+				refreshToken: i
+			});
+		} finally {
+			n.release();
+		}
 	}
-	async function Se(e) {
-		let n = P, r = await B(Q.post(ne, {
+	async function je(e) {
+		if (await xe(), M !== e || (await J().done.catch(() => void 0), j() === null)) throw new t();
+		let n = A().user;
+		return n === null ? me() : n;
+	}
+	async function Me(e) {
+		let n = M, r = await z(Y.post(re, {
 			body: e,
 			skipAuth: !0
-		})), { token: i, refreshToken: a } = b(r);
-		if (P !== n) throw H(i ?? null, a), new t();
-		return H(N(), E() ?? void 0), Y({
+		})), { token: i, refreshToken: a } = y(r);
+		if (M !== n) throw B(i ?? null, a), new t();
+		return B(j(), w() ?? void 0), K({
 			data: r,
 			token: i,
 			refreshToken: a
 		});
 	}
-	async function Y(e) {
-		let { done: n } = X("switch"), r = P;
-		if (await n.catch(() => void 0), P !== r) throw new t();
-		j(u()), M().setToken(e.token), O(e.refreshToken ?? null);
-		let i = oe?.(e.data);
-		return i == null ? ue() : (M().setUser(i), i);
-	}
-	function X(e) {
-		let { user: t, token: n } = M(), r = n !== null || t !== null || E() !== null;
-		return (r || e !== "expired") && W(), M().logout(), O(null), j(null), r ? {
+	async function K(e) {
+		let { done: n } = q("switch"), r = M;
+		if (await n.catch(() => void 0), M !== r) throw new t();
+		k(d()), A().setToken(e.token), E(e.refreshToken ?? null);
+		let i = ce?.(e.data);
+		return i == null ? me() : (A().setUser(i), i);
+	}
+	function q(e) {
+		let { user: t, token: n } = A(), r = n !== null || t !== null || w() !== null;
+		return (r || e !== "expired") && ve(), A().logout(), E(null), k(null), r ? {
 			live: r,
-			done: Ce({
+			done: Ne({
 				reason: e,
 				user: t,
 				token: n,
@@ -245,29 +314,29 @@ function p(a) {
 			})
 		} : {
 			live: r,
-			done: e === "switch" || F === 0 ? de : Promise.resolve()
+			done: e === "switch" || N === 0 ? he : Promise.resolve()
 		};
 	}
-	function Ce(e) {
-		if (!ce) return Promise.resolve();
-		let t = U(e.token);
-		F += 1;
+	function Ne(e) {
+		if (!de) return Promise.resolve();
+		let t = V(e.token);
+		N += 1;
 		let n = (async () => {
 			try {
-				await ce({
+				await de({
 					...e,
 					api: t
 				});
 			} finally {
-				--F;
+				--N;
 			}
 		})();
-		return de = n.then(() => void 0, () => void 0), n.then(() => void 0);
+		return he = n.then(() => void 0, () => void 0), n.then(() => void 0);
 	}
-	function we() {
-		let e = T();
+	function Pe() {
+		let e = C();
 		if (!e) return null;
-		let t = e.getItem(w), n = e.getItem(k), r = e.getItem(g);
+		let t = e.getItem(S), n = e.getItem(D), r = e.getItem(g);
 		if (!r) return {
 			user: null,
 			token: null,
@@ -291,19 +360,19 @@ function p(a) {
 			};
 		}
 	}
-	function Z() {
-		let e = we(), { user: t, token: n } = M();
+	function J() {
+		let e = Pe(), { user: t, token: n } = A();
 		if (e === null) return {
 			continues: !0,
 			done: Promise.resolve()
 		};
 		let r = JSON.stringify(e.user) === JSON.stringify(t);
-		if (e.token === n && e.refreshToken === D && e.lineage === A && r) return {
+		if (e.token === n && e.refreshToken === T && e.lineage === O && r) return {
 			continues: !0,
 			done: Promise.resolve()
 		};
-		let i = e.lineage !== null || A !== null ? e.lineage === A : e.token === n || n !== null && r, a = e.token !== null && i, o = n !== null || t !== null || D !== null;
-		if (a || W(), D = e.refreshToken, A = e.lineage, C.setState({
+		let i = e.lineage !== null || O !== null ? e.lineage === O : e.token === n || n !== null && r, a = e.token !== null && i, o = n !== null || t !== null || T !== null;
+		if (a || ve(), T = e.refreshToken, O = e.lineage, x.setState({
 			user: e.user,
 			token: e.token,
 			isAuthenticated: e.token !== null
@@ -311,7 +380,7 @@ function p(a) {
 			continues: a,
 			done: Promise.resolve()
 		};
-		let s = Ce({
+		let s = Ne({
 			reason: e.token === null ? "logout" : "switch",
 			user: t,
 			token: n,
@@ -322,56 +391,58 @@ function p(a) {
 			done: s
 		};
 	}
-	function Te() {
+	function Fe() {
 		if (!h) return null;
-		let e = h, { token: t, user: n } = M(), r = E();
+		let e = h, { token: t, user: n } = A(), r = w();
 		if (!v && t === null && n === null && r === null) return null;
-		let i = v ? [...R] : [];
-		return V(async () => (await l(i, s), U(t).post(e, { body: x(r) })));
+		let i = v ? [...L] : [];
+		return _e(async () => (await u(i, s), V(t).post(e, { body: b(r) })));
 	}
-	function Ee() {
-		let e = Z();
+	function Ie() {
+		let e = J();
 		if (!e.continues) return e.done;
-		let t = Te(), { done: n } = X("logout");
+		let t = Fe(), { done: n } = q("logout");
 		return t ? Promise.all([t, n]).then(() => void 0) : n;
 	}
-	async function De() {
-		let { live: e, done: t } = X("expired");
-		await t.catch(() => void 0), e && S && typeof window < "u" && window.location.assign(S);
+	async function Le() {
+		let { live: e, done: t } = q("expired");
+		await t.catch(() => void 0), e && ue && typeof window < "u" && window.location.assign(ue);
 	}
-	let Q = n({
-		baseURL: d,
+	let Y = n({
+		baseURL: f,
 		prefix: p,
 		withCredentials: v,
-		csrf: ae,
-		fetcher: y,
-		getToken: N,
-		getSessionEpoch: () => P,
-		refresh: _e,
-		retry: se,
-		onUnauthorized: ve
-	}), Oe = () => q(), $ = null, ke = () => N() === null ? null : A === null ? ($?.epoch !== P && ($ = {
-		epoch: P,
-		key: u()
-	}), $.key) : A, Ae = {
-		current: ke,
-		subscribe: (e) => C.subscribe(e)
+		csrf: oe,
+		fetcher: se,
+		getToken: j,
+		getSessionEpoch: () => M,
+		refresh: Ee,
+		retry: le,
+		onUnauthorized: De
+	}), Re = () => W(), X = null, Z = () => j() === null ? null : O === null ? (X?.epoch !== M && (X = {
+		epoch: M,
+		key: d()
+	}), X.key) : O, Q = {
+		current: Z,
+		subscribe: (e) => x.subscribe(e)
 	};
-	r(Q, Ae), r(N, Ae);
-	function je(e) {
-		e.storageArea === T() && (e.key === null || e.key === g || e.key === w || e.key === k) && Z();
-	}
-	let Me = typeof window > "u" ? null : window;
-	return Me?.addEventListener("storage", je), {
-		useAuthStore: C,
-		api: Q,
-		login: ye,
-		logout: Ee,
-		refresh: Oe,
-		restore: be,
-		getToken: N,
-		sessionKey: ke,
-		dispose: () => Me?.removeEventListener("storage", je)
+	r(Y, Q), r(j, Q), r(Z, Q);
+	let ze = () => P.size === 0 && !(R.size > 0 && j() === null);
+	function Be(e) {
+		e.storageArea === C() && (e.key === null || e.key === g || e.key === S || e.key === D) && J();
+	}
+	let $ = typeof window > "u" ? null : window;
+	return $?.addEventListener("storage", Be), {
+		useAuthStore: x,
+		api: Y,
+		login: Oe,
+		logout: Ie,
+		refresh: Re,
+		restore: ke,
+		getToken: j,
+		sessionKey: Z,
+		isSessionKnown: ze,
+		dispose: () => $?.removeEventListener("storage", Be)
 	};
 }
 //#endregion