tenneo-auth-plugin 0.1.6 → 0.1.8

package/dist/index.d.mts

@@ -8,12 +8,22 @@ declare function bootstrap(): Promise<void>;
 /**
  * Logout functionality.
  * Sets force_login, clears auth storage; does not redirect (bootstrap handles that).
+ *
+ * This module is hardened for:
+ * - Multi-tab race safety (timestamp-based lock)
+ * - Proper server logout validation
+ * - Scoped auth storage cleanup
+ * - Watcher lifecycle correctness
+ * - CSRF protection (when host app provides a token)
  */
 interface LogoutResponse {
     success?: boolean;
     message?: string;
     logout?: boolean;
 }
+/**
+ * Public logout API – keeps signature/backward-compatibility.
+ */
 declare function logout(tenantKey?: string): Promise<{
     success: boolean;
     message: string;

package/dist/index.d.ts

@@ -8,12 +8,22 @@ declare function bootstrap(): Promise<void>;
 /**
  * Logout functionality.
  * Sets force_login, clears auth storage; does not redirect (bootstrap handles that).
+ *
+ * This module is hardened for:
+ * - Multi-tab race safety (timestamp-based lock)
+ * - Proper server logout validation
+ * - Scoped auth storage cleanup
+ * - Watcher lifecycle correctness
+ * - CSRF protection (when host app provides a token)
  */
 interface LogoutResponse {
     success?: boolean;
     message?: string;
     logout?: boolean;
 }
+/**
+ * Public logout API – keeps signature/backward-compatibility.
+ */
 declare function logout(tenantKey?: string): Promise<{
     success: boolean;
     message: string;

package/dist/index.js

@@ -918,10 +918,10 @@ var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
 var INTERNAL_DEFAULTS = {
-  API_TENANT_RESOLUTION_BASE_URL: "https://localhost:5020/api/v1",
-  API_AUTH_BASE_URL: "https://localhost:5001",
-  AUTH_SERVER_URL: "https://localhost:5001",
-  DEFAULT_DOMAIN: "https://localhost:5001"
+  API_TENANT_RESOLUTION_BASE_URL: "http://localhost:5021/api/v1",
+  API_AUTH_BASE_URL: "http://localhost:5000",
+  AUTH_SERVER_URL: "http://localhost:5000",
+  DEFAULT_DOMAIN: "http://localhost:5000"
 };
 function envOr(key) {
   const v = getEnvValue([`VITE_${key}`, key]);
@@ -2005,6 +2005,8 @@ function setDefaultAuthEngine(engine) {
 }
 
 // src/application/token.ts
+var lastNoRefreshLog = 0;
+var NO_REFRESH_LOG_INTERVAL_MS = 5e3;
 async function ensureValidAccessToken() {
   const engine = getDefaultAuthEngine();
   if (engine) {
@@ -2017,7 +2019,11 @@ async function ensureValidAccessToken() {
   if (token && !isAccessTokenExpired()) return token;
   const refreshToken = getRefreshToken();
   if (!refreshToken) {
-    logger.debug("No refresh token - cannot refresh; login required");
+    const now = Date.now();
+    if (now - lastNoRefreshLog >= NO_REFRESH_LOG_INTERVAL_MS) {
+      lastNoRefreshLog = now;
+      logger.debug("No refresh token - cannot refresh; login required");
+    }
     throw new Error("No refresh token; login required");
   }
   return await refreshAccessToken();
@@ -2483,7 +2489,74 @@ function resetCookieWatcher() {
     authCookies
   });
 }
+
+// src/infrastructure/watchers/storage-watcher.ts
+var isWatching2 = false;
+var lastStorageCheck = null;
+var storageEventListener = null;
+function checkStorageCleared() {
+  try {
+    const hasAnyAuthData = Object.values(STORAGE_KEYS).some(
+      (key) => getStorage(key) !== null
+    );
+    if (lastStorageCheck === "had_data" && !hasAnyAuthData) return true;
+    lastStorageCheck = hasAnyAuthData ? "had_data" : "no_data";
+    return false;
+  } catch {
+    return false;
+  }
+}
+function handleStorageEvent(event) {
+  if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
+    const wasCleared = checkStorageCleared();
+    if (wasCleared) {
+      logger.info("Detected manual sessionStorage clear! Redirecting to login...");
+      const cb = getSessionClearedCallback();
+      if (cb) {
+        Promise.resolve(cb()).catch((error) => {
+          logger.error("Failed to redirect to login after manual clear", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+        });
+      }
+    }
+  }
+}
+function startStorageWatcher() {
+  if (isWatching2) return;
+  isWatching2 = true;
+  checkStorageCleared();
+  storageEventListener = handleStorageEvent;
+  window.addEventListener("storage", storageEventListener);
+  const pollInterval = setInterval(() => {
+    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
+    if (logoutInProgress) {
+      logger.debug("Logout detected. Storage watcher will not trigger bootstrap.");
+      return;
+    }
+    const wasCleared = checkStorageCleared();
+    if (wasCleared) {
+      logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
+      clearInterval(pollInterval);
+      const cb = getSessionClearedCallback();
+      if (cb) {
+        Promise.resolve(cb()).catch((error) => {
+          logger.error("Failed to redirect to login after manual clear", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+          if (!isWatching2) startStorageWatcher();
+        });
+      }
+    }
+  }, 1e3);
+  window.__tenneo_auth_storage_watcher_interval = pollInterval;
+}
 function stopStorageWatcher() {
+  isWatching2 = false;
+  if (storageEventListener) {
+    window.removeEventListener("storage", storageEventListener);
+    storageEventListener = null;
+  }
   const win = window;
   const intervalId = win.__tenneo_auth_storage_watcher_interval;
   if (intervalId) {
@@ -2533,51 +2606,68 @@ function buildUrl(baseUrl, path) {
   url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
   return url.toString();
 }
-async function callServerLogout(logoutUrl) {
+function getCsrfToken() {
   try {
+    if (typeof document === "undefined") return null;
+    const meta = document.querySelector('meta[name="csrf-token"]');
+    if (meta?.content) return meta.content;
+    const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]+)/i);
+    if (match) return decodeURIComponent(match[1]);
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function callServerLogout(logoutUrl) {
+  const csrfToken = getCsrfToken();
+  async function doRequest(method) {
+    const isPost = method === "POST";
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      Accept: "application/json, */*"
+    };
+    if (isPost) {
+      headers["Content-Type"] = "application/x-www-form-urlencoded";
+    }
+    if (csrfToken) {
+      headers["X-CSRF-Token"] = csrfToken;
+    }
     const response = await fetch(logoutUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        "X-Requested-With": "XMLHttpRequest",
-        Accept: "application/json"
-      },
+      method,
+      mode: "cors",
+      headers,
       credentials: "include"
     });
+    if (!response.ok) {
+      logger.warn("Server logout HTTP error", {
+        method,
+        status: response.status,
+        statusText: response.statusText
+      });
+      return { success: false };
+    }
     const data = await response.json().catch(() => ({}));
-    logger.info("Server logout response (POST)", { response: data });
+    logger.info(`Server logout response (${method})`, { response: data });
     if (data && (data.success === true || data.logout === true)) {
       return { success: true, response: data };
     }
-    logger.warn("Server logout response invalid (POST)", { response: data });
+    logger.warn("Server logout response invalid payload", {
+      method,
+      response: data
+    });
     return { success: false, response: data };
+  }
+  try {
+    const postResult = await doRequest("POST");
+    if (postResult.success) return postResult;
+    logger.debug("POST logout did not succeed, trying GET");
+    const getResult = await doRequest("GET");
+    return getResult;
   } catch (error) {
-    logger.debug("POST logout failed, trying GET", {
+    logger.warn("Server logout failed (both POST and GET)", {
       error: error instanceof Error ? error.message : String(error)
     });
-    try {
-      const response = await fetch(logoutUrl, {
-        method: "GET",
-        headers: {
-          "X-Requested-With": "XMLHttpRequest",
-          Accept: "application/json"
-        },
-        credentials: "include"
-      });
-      const data = await response.json().catch(() => ({}));
-      logger.info("Server logout response (GET)", { response: data });
-      if (data && (data.success === true || data.logout === true)) {
-        return { success: true, response: data };
-      }
-      logger.warn("Server logout response invalid (GET)", { response: data });
-      return { success: false, response: data };
-    } catch (getError) {
-      logger.warn("Server logout failed (both POST and GET)", {
-        postError: error instanceof Error ? error.message : String(error),
-        getError: getError instanceof Error ? getError.message : String(getError)
-      });
-      return { success: false };
-    }
+    return { success: false };
   }
 }
 function performLocalLogoutCleanup() {
@@ -2590,18 +2680,46 @@ function performLocalLogoutCleanup() {
     });
   }
   clearClientCookies();
-  clearAllStorage();
+  try {
+    clearAuthStorage();
+  } catch (error) {
+    logger.warn("clearAuthStorage failed (ignored)", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
   logger.info("Local logout cleanup completed");
 }
+function acquireLogoutLock() {
+  const LOCK_KEY = getStorageKey("logout_lock");
+  const now = Date.now();
+  const existingLock = getStorage(LOCK_KEY);
+  if (existingLock) {
+    const lockTime = Number(existingLock);
+    if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
+      logger.debug("Logout lock active \u2013 skipping duplicate logout", {
+        now,
+        lockTime
+      });
+      return false;
+    }
+  }
+  setStorage(LOCK_KEY, String(now));
+  return true;
+}
+function releaseLogoutLock() {
+  try {
+    removeStorage(getStorageKey("logout_lock"));
+  } catch {
+  }
+}
 async function logout(tenantKey) {
-  setStorage(getStorageKey("logout_in_progress"), "true");
   setStorage(getStorageKey("force_login"), "true");
-  if (tenantKey?.trim()) setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
-  if (getStorage(getStorageKey("logout_processing")) === "true") {
-    logger.debug("Logout already in progress \u2013 skipping duplicate call");
+  if (tenantKey?.trim()) {
+    setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
+  }
+  if (!acquireLogoutLock()) {
     return { success: true, message: "Logout already in progress." };
   }
-  setStorage(getStorageKey("logout_processing"), "true");
   try {
     stopStorageWatcher();
     stopCookieWatcher();
@@ -2614,20 +2732,45 @@ async function logout(tenantKey) {
       const logoutResult = await callServerLogout(logoutUrl);
       serverLogoutSuccess = logoutResult.success;
       serverResponse = logoutResult.response;
+      if (!serverLogoutSuccess) {
+        logger.warn("Server logout failed \u2013 session may still exist", {
+          logoutUrl,
+          serverResponse
+        });
+      }
+    } else {
+      logger.warn("API auth base URL not configured, performing local logout only");
     }
     performLocalLogoutCleanup();
     const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
     if (preservedTenantKey) {
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: preservedTenantKey }));
+      const propsKey = getStorageKey("props_config");
+      let existing = {};
+      try {
+        const raw = getStorage(propsKey);
+        if (raw) {
+          existing = JSON.parse(raw);
+        }
+      } catch {
+        existing = {};
+      }
+      const merged = {
+        ...existing,
+        tenantKey: preservedTenantKey
+      };
+      setStorage(propsKey, JSON.stringify(merged));
       removeStorage(getStorageKey("preserved_tenant_key"));
     }
     resetCookieWatcher();
-    removeStorage(getStorageKey("logout_processing"));
+    startStorageWatcher();
+    releaseLogoutLock();
     logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
       serverLogoutSuccess,
       serverResponse
     });
     emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+      serverLogoutSuccess,
+      tenantKey: getStorage(getStorageKey("preserved_tenant_key")) || void 0,
       message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
     });
     return {
@@ -2642,10 +2785,24 @@ async function logout(tenantKey) {
     performLocalLogoutCleanup();
     const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
     if (preservedTenantKey) {
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: preservedTenantKey }));
+      const propsKey = getStorageKey("props_config");
+      let existing = {};
+      try {
+        const raw = getStorage(propsKey);
+        if (raw) {
+          existing = JSON.parse(raw);
+        }
+      } catch {
+        existing = {};
+      }
+      const merged = {
+        ...existing,
+        tenantKey: preservedTenantKey
+      };
+      setStorage(propsKey, JSON.stringify(merged));
       removeStorage(getStorageKey("preserved_tenant_key"));
     }
-    removeStorage(getStorageKey("logout_processing"));
+    releaseLogoutLock();
     return {
       success: true,
       message: "Logged out locally due to an error. Fresh login required."