tosijs-ui 1.16.29 → 1.16.30

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.16.30
+
+### Tunnel
+
+- **A dev-server restart no longer costs a key holder their next save.** `bun start` restarts
+  the server whenever a file in its import graph changes, and that includes every component
+  source, so editing an example restarts it. Save to source writes such a file, so the save
+  itself restarted the server, and the NEXT save from the same page was told "This workspace
+  needs an invite link". Reloading recovered the session but lost the unsaved edit. Now a
+  request from the workspace's own page that holds the global key cookie is given a fresh
+  session in place, and the haltija agent bridge's reconnection is too. "Own page" means
+  `Sec-Fetch-Site: same-origin` or an `Origin` that is this host; a sibling workspace's page,
+  which receives the same cookie, gets nothing, nor does a request with neither header. A
+  session opened from a plain `--link` holds no key, so a restart still ends it.
+- **For a key holder, the key cookie now bounds access, not the session.** A key opens a
+  one-day session, but the cookie renews it, so access lasts as long as the cookie (30 days for
+  the edit key) or until you rotate the key and restart the dev servers.
+
 ## 1.16.29
 
 ### Doc system

package/dist/doc-system/site/dev-auth.d.ts

@@ -422,13 +422,16 @@ export declare const GLOBAL_EDIT_COOKIE = "tosi_edit";
 export declare const GLOBAL_KEY_MIN_LENGTH = 24;
 /**
  * A session minted from a global key lasts a day, or until this dev server stops (sessions
- * live in memory). The key is NOT re-checked while the session lives, so rotating a key ends
- * the sessions it already opened only when each workspace restarts.
+ * live in memory). While the key cookie lasts, the next page load or same-origin request mints
+ * another, so for a key holder it is the COOKIE's lifetime that ends access, not this. The key
+ * is NOT re-checked while a session lives, so rotating a key ends the sessions it already opened
+ * only when each workspace restarts.
  */
 export declare const GLOBAL_KEY_SESSION_TTL_MS: number;
 /**
  * The most live sessions one server holds; past it the oldest goes. Only a key holder can mint
- * one per page load, so this bounds a browser stuck reloading, not an attacker.
+ * one: per page load, and per request from a page left open across a restart until its first
+ * renewed cookie lands. So this bounds a browser stuck reloading, not an attacker.
  */
 export declare const MAX_SESSIONS = 1000;
 export interface GlobalKeys {
@@ -483,6 +486,41 @@ export declare function globalKeyExchange(request: {
     keys: GlobalKeys;
     now: number;
 }): 'edit' | 'view' | null;
+/**
+ * Should a request from this workspace's OWN page, that is not a page load, trade a global key
+ * for a session in place?
+ *
+ * Sessions live in memory, and `bun start` restarts the process whenever a file in its import
+ * graph changes, which includes every component source and so every doc-comment example. Save
+ * to source writes exactly such a file. So the save restarts the server, and the next save from
+ * the same page arrived holding a dead session and was told "This workspace needs an invite
+ * link". A reload would have exchanged the key, and lost the unsaved edit (the maintainer,
+ * 2026-10-20: a restart must not reset a key holder).
+ *
+ * The answer is the page-load exchange's, with two extra conditions, because no redirect is
+ * involved: the session is issued and used on this same request.
+ * - Positive evidence that the request comes from this origin: `Sec-Fetch-Site: same-origin`,
+ *   or, from a browser that sends no fetch metadata, an `Origin` that is this host. Absence of
+ *   both is NOT enough here (unlike `isSameOriginRequest`, which allows it for curl and our
+ *   own CLI, whose requests are not a browser spending an ambient cookie): every host under the preview domain
+ *   is the same site and receives the key cookie, so a sibling workspace's page must not be
+ *   able to spend it here.
+ *
+ * A WebSocket upgrade (the haltija bridge) qualifies too; browsers send `Origin` and
+ * `Sec-Fetch-Site` on the handshake, and the 101 carries the cookie.
+ */
+export declare function globalKeyRefresh(request: {
+    method: string;
+    headers: {
+        get(name: string): string | null;
+    };
+}, opts: {
+    viaTunnel: boolean;
+    host: string;
+    auth: AuthState;
+    keys: GlobalKeys;
+    now: number;
+}): 'edit' | 'view' | null;
 /**
  * The origin allowed to read this workspace's liveness answer: the box's own list.
  *

package/dist/doc-system/site/dev-auth.js

@@ -867,13 +867,16 @@ export const GLOBAL_EDIT_COOKIE = 'tosi_edit';
 export const GLOBAL_KEY_MIN_LENGTH = 24;
 /**
  * A session minted from a global key lasts a day, or until this dev server stops (sessions
- * live in memory). The key is NOT re-checked while the session lives, so rotating a key ends
- * the sessions it already opened only when each workspace restarts.
+ * live in memory). While the key cookie lasts, the next page load or same-origin request mints
+ * another, so for a key holder it is the COOKIE's lifetime that ends access, not this. The key
+ * is NOT re-checked while a session lives, so rotating a key ends the sessions it already opened
+ * only when each workspace restarts.
  */
 export const GLOBAL_KEY_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 /**
  * The most live sessions one server holds; past it the oldest goes. Only a key holder can mint
- * one per page load, so this bounds a browser stuck reloading, not an attacker.
+ * one: per page load, and per request from a page left open across a restart until its first
+ * renewed cookie lands. So this bounds a browser stuck reloading, not an attacker.
  */
 export const MAX_SESSIONS = 1000;
 /**
@@ -944,7 +947,10 @@ export function isNavigation(request) {
 export function globalKeyExchange(request, opts) {
     if (!opts.viaTunnel || !isNavigation(request))
         return null;
-    const header = request.headers.get('cookie');
+    return keyAddsAccess(request.headers.get('cookie'), opts);
+}
+/** What a global key would add to this request's session: nothing, or a session of a kind. */
+function keyAddsAccess(header, opts) {
     const access = globalKeyAccess(header, opts.keys);
     if (!access)
         return null;
@@ -955,6 +961,41 @@ export function globalKeyExchange(request, opts) {
     }
     return access;
 }
+/**
+ * Should a request from this workspace's OWN page, that is not a page load, trade a global key
+ * for a session in place?
+ *
+ * Sessions live in memory, and `bun start` restarts the process whenever a file in its import
+ * graph changes, which includes every component source and so every doc-comment example. Save
+ * to source writes exactly such a file. So the save restarts the server, and the next save from
+ * the same page arrived holding a dead session and was told "This workspace needs an invite
+ * link". A reload would have exchanged the key, and lost the unsaved edit (the maintainer,
+ * 2026-10-20: a restart must not reset a key holder).
+ *
+ * The answer is the page-load exchange's, with two extra conditions, because no redirect is
+ * involved: the session is issued and used on this same request.
+ * - Positive evidence that the request comes from this origin: `Sec-Fetch-Site: same-origin`,
+ *   or, from a browser that sends no fetch metadata, an `Origin` that is this host. Absence of
+ *   both is NOT enough here (unlike `isSameOriginRequest`, which allows it for curl and our
+ *   own CLI, whose requests are not a browser spending an ambient cookie): every host under the preview domain
+ *   is the same site and receives the key cookie, so a sibling workspace's page must not be
+ *   able to spend it here.
+ *
+ * A WebSocket upgrade (the haltija bridge) qualifies too; browsers send `Origin` and
+ * `Sec-Fetch-Site` on the handshake, and the 101 carries the cookie.
+ */
+export function globalKeyRefresh(request, opts) {
+    if (!opts.viaTunnel || isNavigation(request))
+        return null;
+    const site = request.headers.get('sec-fetch-site');
+    const origin = request.headers.get('origin');
+    const ours = site !== null
+        ? site === 'same-origin'
+        : origin !== null && origin === `https://${opts.host.toLowerCase()}`;
+    if (!ours)
+        return null;
+    return keyAddsAccess(request.headers.get('cookie'), opts);
+}
 /**
  * The origin allowed to read this workspace's liveness answer: the box's own list.
  *

package/dist/doc-system/site/dev-server.d.ts

@@ -150,6 +150,22 @@ export declare function haltijaTunnelLoaderSnippet(): string;
 /** Same-origin paths the tunnel bridge serves. One place, so the loader and the routes agree. */
 export declare const HALTIJA_BRIDGE_PREFIX = "/__haltija/";
 export declare const HALTIJA_BRIDGE_WS = "/__haltija/ws";
+/** The slice of a `Bun.Server` the request handler uses. */
+export type Upgrader = {
+    requestIP?: (r: Request) => {
+        address?: string;
+    } | null;
+    upgrade?: (r: Request, opts?: {
+        data?: unknown;
+        headers?: Record<string, string>;
+    }) => boolean;
+};
+/**
+ * The same server, except that an accepted WebSocket upgrade also sets `setCookie` on its 101.
+ * How a renewed session reaches a browser whose request was a handshake (the haltija bridge),
+ * which has no Response of ours to carry it.
+ */
+export declare function upgraderSettingCookie(srv: Upgrader, setCookie: string): Upgrader;
 export declare const HALTIJA_BRIDGE_COMPONENT = "/__haltija/component.js";
 /** br if the client takes it, else gzip, else nothing. */
 export declare function negotiateEncoding(accept: string | null): 'br' | 'gzip' | null;

package/dist/doc-system/site/dev-server.js

@@ -22,7 +22,7 @@ import { resolveTunnelLocalPort } from './site-config.js';
 import { acquireBuildLock, describeHolder } from './build-lock.js';
 import { sinkPathFor, appendToSink } from './debug-sink.js';
 import { invitePageHtml } from './invite-page.js';
-import { TUNNEL_LINK_CMD, resolveLinkArrival, isLockedDown, hasTunnel, isLoopbackAddressForAuth as isLoopbackAddress, mayReadSite, shouldInterceptLinkToken, createAuthState, issueLink, globalKeyCookie, grantDomainFor, takeSessionGrant, outstandingGrants, MAX_OUTSTANDING_GRANTS, resolveShareTtlMs, readCookie, redeemThroughGate, createRedemptionGate, resolveLinkSettings, sessionCookie, urlWithoutToken, sameOriginPath, isSameOriginRequest, validSessionCookie, sessionRejection, haltijaBridgeAdmission, isProxiedRequest, sourceRequestAdmission, trustLanRefusalHint, trustLanWriteRecord, resolveLanTrust, describeLanTrust, resolveGlobalKeys, globalKeyAccess, globalKeyExchange, liveProbeOrigin, issueSession, cookieMayWrite, GLOBAL_KEY_SESSION_TTL_MS, SESSION_COOKIE, } from './dev-auth.js';
+import { TUNNEL_LINK_CMD, resolveLinkArrival, isLockedDown, hasTunnel, isLoopbackAddressForAuth as isLoopbackAddress, mayReadSite, shouldInterceptLinkToken, createAuthState, issueLink, globalKeyCookie, grantDomainFor, takeSessionGrant, outstandingGrants, MAX_OUTSTANDING_GRANTS, resolveShareTtlMs, readCookie, redeemThroughGate, createRedemptionGate, resolveLinkSettings, sessionCookie, urlWithoutToken, sameOriginPath, isSameOriginRequest, validSessionCookie, sessionRejection, haltijaBridgeAdmission, isProxiedRequest, sourceRequestAdmission, trustLanRefusalHint, trustLanWriteRecord, resolveLanTrust, describeLanTrust, resolveGlobalKeys, globalKeyAccess, globalKeyExchange, globalKeyRefresh, liveProbeOrigin, issueSession, cookieMayWrite, GLOBAL_KEY_SESSION_TTL_MS, SESSION_COOKIE, } from './dev-auth.js';
 import { readLocalSecret } from './local-secrets.js';
 import { resolveDataStore, resolveDataFile, dataContentProblem, listDataFiles, saveDataFile, dataHistory, readDataAt, isGitWorkTree, } from './data-store.js';
 import { SOURCE_ACCESS_HEADER, SOURCE_ENDPOINT_SNIPPET, } from '../../live-example/source-access.js';
@@ -361,6 +361,20 @@ export function haltijaTunnelLoaderSnippet() {
 /** Same-origin paths the tunnel bridge serves. One place, so the loader and the routes agree. */
 export const HALTIJA_BRIDGE_PREFIX = '/__haltija/';
 export const HALTIJA_BRIDGE_WS = '/__haltija/ws';
+/**
+ * The same server, except that an accepted WebSocket upgrade also sets `setCookie` on its 101.
+ * How a renewed session reaches a browser whose request was a handshake (the haltija bridge),
+ * which has no Response of ours to carry it.
+ */
+export function upgraderSettingCookie(srv, setCookie) {
+    return {
+        requestIP: (r) => srv.requestIP?.(r) ?? null,
+        upgrade: (r, opts) => srv.upgrade?.(r, {
+            ...opts,
+            headers: { ...opts?.headers, 'Set-Cookie': setCookie },
+        }) ?? false,
+    };
+}
 export const HALTIJA_BRIDGE_COMPONENT = '/__haltija/component.js';
 /**
  * Reclaim the port we are about to bind, from the process LISTENING on it.
@@ -1725,6 +1739,46 @@ export async function devServer(config, opts = {}) {
     outright. Source and data writes check same-origin on both paths (sourceRequestAdmission).
     */
     const csrfOk = (request, viaTunnel) => viaTunnel || isSameOriginRequest(request);
+    /*
+    A request from this workspace's own page that holds a global key but a dead session (the
+    server restarted under it) is served with a fresh session, which its response hands back.
+    See `globalKeyRefresh`. The session goes into the request's cookie header, so every gate in
+    handleRequest sees a session and none of them has to know about keys. A WebSocket upgrade
+    (the haltija bridge) carries the cookie on its 101, through `upgrade`'s headers.
+    */
+    // Said once per process: a page left open across a restart renews on every request it makes.
+    let renewalLogged = false;
+    const withKeySession = async (request, srv, handle) => {
+        const grant = globalKeyRefresh(request, {
+            viaTunnel: true,
+            host: request.headers.get('host') ?? '',
+            auth,
+            keys: globalKeys.keys,
+            now: Date.now(),
+        });
+        if (!grant)
+            return handle(request, srv);
+        const session = issueSession(auth, Date.now(), GLOBAL_KEY_SESSION_TTL_MS, grant === 'view');
+        const setCookie = sessionCookie(session, GLOBAL_KEY_SESSION_TTL_MS);
+        const headers = new Headers(request.headers);
+        const others = (headers.get('cookie') ?? '')
+            .split(';')
+            .map((c) => c.trim())
+            .filter((c) => c && !c.startsWith(`${SESSION_COOKIE}=`));
+        // The `name=value` pair the browser will send from now on.
+        headers.set('cookie', [...others, setCookie.split(';')[0]].join('; '));
+        if (!renewalLogged) {
+            renewalLogged = true;
+            console.log(`🔓 global ${grant} key — session renewed after a restart`);
+        }
+        const response = await handle(new Request(request, { headers }), srv && upgraderSettingCookie(srv, setCookie));
+        // An accepted upgrade answers with nothing; its cookie went out on the 101.
+        if (!response)
+            return response;
+        const refreshed = new Response(response.body, response);
+        refreshed.headers.append('Set-Cookie', setCookie);
+        return refreshed;
+    };
     const handleRequest = async (request, srv, viaTunnel) => {
         /*
         A REQUEST is activity. This was lost in the two-listener refactor, leaving the only
@@ -2490,7 +2544,7 @@ export async function devServer(config, opts = {}) {
                 // Same reasoning as the main listener — a tunnelled load is slower, not faster.
                 idleTimeout: DEV_IDLE_TIMEOUT_SECONDS,
                 hostname: '127.0.0.1',
-                fetch: (request, srv) => handleRequest(request, srv, true),
+                fetch: (request, srv) => withKeySession(request, srv, (r, s) => handleRequest(r, s, true)),
                 websocket: haltijaWebSocketHandlers,
             });
             console.log(`Tunnel listener on http://127.0.0.1:${tunnelPort} (loopback only; writes require a session)`);