lendry/IdP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix and update

Browse Source
This commit is contained in:
lendry
2026-06-30 09:39:35 +03:00
parent 250976ca08
commit 4e98f6bfab
8 changed files with 192 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
apps/frontend/components/id/auth-provider.tsx
View File

@@ -16,6 +16,9 @@ import {
buildAuthDevicePayload,
IdentifyResponse,
getApiErrorMessage,
invalidateApiGatewayReady,
isApiGatewayReady,
isGatewayUnavailableError,
isPinRequiredError,
OtpSendResponse,
PasswordlessAuthResponse,
@@ -25,6 +28,7 @@ import {
resetPinRequiredNotification,
scheduleFedcmSessionSync,
setPinRequiredHandler,
subscribeApiReady,
} from '@/lib/api';
import { useToast } from './toast-provider';
import { PinLockModal } from './pin-lock-modal';
@@ -35,6 +39,7 @@ interface AuthContextValue {
user: PublicUser | null;
token: string | null;
isLoading: boolean;
isApiReady: boolean;
isPinLocked: boolean;
hasStoredSession: boolean;
login: (login: string, password: string) => Promise<AuthTokens>;
@@ -103,6 +108,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
const [token, setToken] = React.useState<string | null>(null);
const [user, setUser] = React.useState<PublicUser | null>(null);
const [isLoading, setIsLoading] = React.useState(true);
const [isApiReady, setIsApiReady] = React.useState(false);
const [isPinLocked, setIsPinLocked] = React.useState(false);
const [hasStoredSession, setHasStoredSession] = React.useState(false);
const [lockedSessionId, setLockedSessionId] = React.useState<string | null>(null);
@@ -112,6 +118,15 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
const refreshInFlightRef = React.useRef<Promise<void> | null>(null);
const initialBootstrapDoneRef = React.useRef(false);
React.useEffect(() => {
if (isApiGatewayReady()) {
setIsApiReady(true);
}
return subscribeApiReady(() => {
setIsApiReady(true);
});
}, []);
React.useEffect(() => {
isPinLockedRef.current = isPinLocked;
}, [isPinLocked]);
@@ -160,6 +175,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
setHasStoredSession(true);
clearPinLock();
initialBootstrapDoneRef.current = true;
setIsApiReady(true);
setIsLoading(false);
if (auth.pinVerified !== false) {
scheduleFedcmSessionSync(auth.accessToken, 2000);
@@ -186,7 +202,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
return refreshInFlightRef.current;
}
const task = (async () => {
const task: Promise<void> = (async () => {
const currentToken = window.localStorage.getItem(AUTH_TOKEN_KEY);
const refreshToken = window.localStorage.getItem(AUTH_REFRESH_KEY);
setHasStoredSession(Boolean(refreshToken));
@@ -200,10 +216,15 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
const isInitialBootstrap = !initialBootstrapDoneRef.current;
if (isInitialBootstrap) {
setIsLoading(true);
await ensureApiGatewayReady();
}
try {
for (let bootstrapAttempt = 0; bootstrapAttempt < 6; bootstrapAttempt += 1) {
try {
if (isInitialBootstrap) {
await ensureApiGatewayReady();
}
if (currentToken) {
setToken(currentToken);
try {
@@ -247,6 +268,11 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
throw new ApiError('Сессия недействительна', 401);
} catch (error) {
if (isGatewayUnavailableError(error) && isInitialBootstrap && bootstrapAttempt + 1 < 6) {
invalidateApiGatewayReady();
await new Promise((resolve) => setTimeout(resolve, 1200));
continue;
}
if (isPinRequiredError(error)) {
activatePinLock(error.sessionId ?? window.localStorage.getItem(AUTH_SESSION_KEY) ?? '');
return;
@@ -262,16 +288,22 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
const message = getApiErrorMessage(error, 'Не удалось загрузить профиль');
if (message) showToast(message);
logout();
return;
}
}
} finally {
if (isInitialBootstrap) {
initialBootstrapDoneRef.current = true;
setIsApiReady(isApiGatewayReady());
setIsLoading(false);
}
refreshInFlightRef.current = null;
}
})();
refreshInFlightRef.current = task;
void task.finally(() => {
refreshInFlightRef.current = null;
});
return task;
}, [activatePinLock, clearPinLock, logout, showToast]);
@@ -510,7 +542,9 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
);
const isBootstrapping =
isLoading && !isPinLocked && Boolean(hasStoredSession || token || user);
!isPinLocked &&
Boolean(hasStoredSession || token || user) &&
(isLoading || !isApiReady);
return (
<AuthContext.Provider
@@ -518,6 +552,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
user,
token,
isLoading,
isApiReady,
isPinLocked,
hasStoredSession,
login,

6
apps/frontend/components/notifications/notification-bell.tsx
View File

@@ -27,7 +27,7 @@ function formatTime(value: string) {
export function NotificationBell() {
const router = useRouter();
const { token, isPinLocked, isLoading } = useAuth();
const { token, isPinLocked, isLoading, isApiReady } = useAuth();
const { showToast } = useToast();
const { unreadCount, setUnreadCount, subscribe } = useRealtime();
const [open, setOpen] = useState(false);
@@ -36,7 +36,7 @@ export function NotificationBell() {
const [respondingId, setRespondingId] = useState<string | null>(null);
const load = useCallback(async () => {
if (!token || isPinLocked || isLoading) return;
if (!token || isPinLocked || isLoading || !isApiReady) return;
setLoading(true);
try {
const [list, count] = await Promise.all([fetchNotifications(token), fetchUnreadNotificationCount(token)]);
@@ -48,7 +48,7 @@ export function NotificationBell() {
} finally {
setLoading(false);
}
}, [isLoading, isPinLocked, setUnreadCount, showToast, token]);
}, [isApiReady, isLoading, isPinLocked, setUnreadCount, showToast, token]);
useEffect(() => {
void load();

6
apps/frontend/components/notifications/realtime-provider.tsx
View File

@@ -31,7 +31,7 @@ interface RealtimeContextValue {
const RealtimeContext = React.createContext<RealtimeContextValue | null>(null);
export function RealtimeProvider({ children }: { children: React.ReactNode }) {
const { user, token, isPinLocked, isLoading } = useAuth();
const { user, token, isPinLocked, isLoading, isApiReady } = useAuth();
const [unreadCount, setUnreadCount] = React.useState(0);
const [connected, setConnected] = React.useState(false);
const listenersRef = React.useRef(new Set<Listener>());
@@ -48,7 +48,7 @@ export function RealtimeProvider({ children }: { children: React.ReactNode }) {
}, []);
React.useEffect(() => {
if (!user || !token || isPinLocked || isLoading) {
if (!user || !token || isPinLocked || isLoading || !isApiReady) {
socketRef.current?.close();
socketRef.current = null;
setConnected(false);
@@ -121,7 +121,7 @@ export function RealtimeProvider({ children }: { children: React.ReactNode }) {
socketRef.current = null;
setConnected(false);
};
}, [emit, isLoading, isPinLocked, token, user]);
}, [emit, isApiReady, isLoading, isPinLocked, token, user]);
return (
<RealtimeContext.Provider value={{ unreadCount, setUnreadCount, subscribe, connected }}>

8
apps/frontend/hooks/use-avatar-url.ts
View File

@@ -12,12 +12,12 @@ interface AvatarAccessResponse {
}
export function useAvatarUrl(userId: string | undefined, hasAvatar: boolean | undefined, token: string | null) {
const { isPinLocked, isLoading } = useAuth();
const { isPinLocked, isLoading, isApiReady } = useAuth();
const [accessUrl, setAccessUrl] = useState<string | null>(null);
const [resolvingAccessUrl, setResolvingAccessUrl] = useState(false);
const refreshAccessUrl = useCallback(async () => {
if (!userId || !token || !hasAvatar || isPinLocked || isLoading) {
if (!userId || !token || !hasAvatar || isPinLocked || isLoading || !isApiReady) {
setAccessUrl(null);
setResolvingAccessUrl(false);
return;
@@ -31,7 +31,7 @@ export function useAvatarUrl(userId: string | undefined, hasAvatar: boolean | un
} finally {
setResolvingAccessUrl(false);
}
}, [hasAvatar, isLoading, isPinLocked, token, userId]);
}, [hasAvatar, isApiReady, isLoading, isPinLocked, token, userId]);
useEffect(() => {
void refreshAccessUrl();
@@ -59,7 +59,7 @@ export function useAvatarUrl(userId: string | undefined, hasAvatar: boolean | un
isLoading: isLoadingBlob,
hasError
} = useResilientBlobUrl(accessUrl, token, {
enabled: Boolean(hasAvatar && accessUrl && !isPinLocked && !isLoading),
enabled: Boolean(hasAvatar && accessUrl && !isPinLocked && !isLoading && isApiReady),
label: `аватар ${userId ?? ''}`.trim()
});

6
apps/frontend/hooks/use-e2e-chat.ts
View File

@@ -52,7 +52,7 @@ export function useE2EChat(options: {
userId?: string;
token?: string | null;
}) {
const { isLoading } = useAuth();
const { isLoading, isApiReady } = useAuth();
const isE2E = options.room?.type === 'E2E';
const peerUserId = useMemo(
() => resolveChatPeerUserId(options.room, options.userId),
@@ -65,7 +65,7 @@ export function useE2EChat(options: {
const [e2eErrors, setE2eErrors] = useState<Record<string, string>>({});
useEffect(() => {
if (!options.userId || !options.token || isLoading) return;
if (!options.userId || !options.token || isLoading || !isApiReady) return;
void (async () => {
try {
const { publicKey } = await ensureE2EKeyPair(options.userId!);
@@ -74,7 +74,7 @@ export function useE2EChat(options: {
// фоновая инициализация E2E
}
})();
}, [isLoading, options.token, options.userId]);
}, [isApiReady, isLoading, options.token, options.userId]);
useEffect(() => {
if (!isE2E || !peerUserId || !options.token) {

10
apps/frontend/hooks/use-primary-family.ts
View File

@@ -13,7 +13,7 @@ import {
} from '@/lib/api';
export function useSelectedFamily(enabled = true) {
const { user, token, isPinLocked, isLoading } = useAuth();
const { user, token, isPinLocked, isLoading, isApiReady } = useAuth();
const { selectedGroupId, setSelectedGroupId } = useFamilyOverlay();
const [groups, setGroups] = useState<FamilyGroup[]>([]);
const [group, setGroup] = useState<FamilyGroup | null>(null);
@@ -22,7 +22,7 @@ export function useSelectedFamily(enabled = true) {
const refresh = useCallback(async () => {
const accessToken = getAccessToken() ?? token?.trim() ?? null;
if (!enabled || !user || !accessToken || isPinLocked || isLoading) {
if (!enabled || !user || !accessToken || isPinLocked || isLoading || !isApiReady) {
setGroups([]);
setGroup(null);
setPresenceMembers([]);
@@ -62,7 +62,7 @@ export function useSelectedFamily(enabled = true) {
} finally {
setLoading(false);
}
}, [enabled, isLoading, isPinLocked, selectedGroupId, setSelectedGroupId, token, user]);
}, [enabled, isApiReady, isLoading, isPinLocked, selectedGroupId, setSelectedGroupId, token, user]);
useEffect(() => {
setLoading(true);
@@ -71,10 +71,10 @@ export function useSelectedFamily(enabled = true) {
useEffect(() => {
const accessToken = getAccessToken() ?? token?.trim() ?? null;
if (!enabled || !accessToken || isPinLocked || isLoading || !group) return;
if (!enabled || !accessToken || isPinLocked || isLoading || !isApiReady || !group) return;
const timer = window.setInterval(() => void refresh(), 25_000);
return () => window.clearInterval(timer);
}, [enabled, group, isLoading, isPinLocked, refresh, token]);
}, [enabled, group, isApiReady, isLoading, isPinLocked, refresh, token]);
const presenceByUserId = useMemo(
() => new Map(presenceMembers.map((member) => [member.userId, member])),

9
apps/frontend/hooks/use-require-auth.ts
View File

@@ -7,19 +7,20 @@ import { useAuth } from '@/components/id/auth-provider';
export function useRequireAuth() {
const router = useRouter();
const pathname = usePathname();
const { user, isLoading, isPinLocked, hasStoredSession } = useAuth();
const { user, isLoading, isApiReady, isPinLocked, hasStoredSession } = useAuth();
useEffect(() => {
if (isLoading) return;
if (isLoading || !isApiReady) return;
if (user || isPinLocked || hasStoredSession) return;
if (pathname.startsWith('/auth/')) return;
router.replace('/auth/login');
}, [hasStoredSession, isLoading, isPinLocked, pathname, router, user]);
}, [hasStoredSession, isApiReady, isLoading, isPinLocked, pathname, router, user]);
return {
user,
isLoading,
isPinLocked,
isReady: !isLoading && Boolean(user || isPinLocked || hasStoredSession)
isApiReady,
isReady: !isLoading && isApiReady && Boolean(user || isPinLocked || hasStoredSession)
};
}

62
apps/frontend/lib/api.ts
View File

@@ -677,9 +677,11 @@ export function buildSystemSettingPayload(setting: Pick<SystemSetting, 'key' | '
}
const GATEWAY_RETRY_STATUS = new Set([502, 503, 504]);
const GATEWAY_RETRY_ATTEMPTS = 2;
const GATEWAY_PROBE_MAX_ATTEMPTS = 4;
const GATEWAY_PROBE_DELAY_MS = 600;
const GATEWAY_RETRY_ATTEMPTS = 4;
const GATEWAY_PROBE_MAX_ATTEMPTS = 48;
const GATEWAY_PROBE_BASE_DELAY_MS = 450;
const API_MAX_CONCURRENT = 8;
const API_READY_EVENT = 'idp-api-ready';
function sleep(ms: number): Promise<void> {
return new Promise((resolve) => setTimeout(resolve, ms));
@@ -687,6 +689,8 @@ function sleep(ms: number): Promise<void> {
let gatewayReadyResolved = false;
let gatewayReadyPromise: Promise<void> | null = null;
let activeApiRequests = 0;
const apiRequestWaiters: Array<() => void> = [];
export function resetApiGatewayWarmup() {
gatewayReadyResolved = false;
@@ -702,10 +706,41 @@ export function isApiGatewayReady() {
}
export function markApiGatewayReady() {
if (gatewayReadyResolved) return;
gatewayReadyResolved = true;
if (typeof window !== 'undefined') {
window.dispatchEvent(new CustomEvent(API_READY_EVENT));
}
}
/** Liveness: nginx → api-gateway HTTP. Не /health/ready — gRPC 503 не должен блокировать SPA и засорять консоль. */
export function subscribeApiReady(listener: () => void): () => void {
if (typeof window === 'undefined') return () => undefined;
if (gatewayReadyResolved) {
listener();
return () => undefined;
}
window.addEventListener(API_READY_EVENT, listener);
return () => window.removeEventListener(API_READY_EVENT, listener);
}
async function acquireApiSlot(): Promise<void> {
if (activeApiRequests < API_MAX_CONCURRENT) {
activeApiRequests += 1;
return;
}
await new Promise<void>((resolve) => {
apiRequestWaiters.push(resolve);
});
activeApiRequests += 1;
}
function releaseApiSlot(): void {
activeApiRequests = Math.max(0, activeApiRequests - 1);
const next = apiRequestWaiters.shift();
if (next) next();
}
/** Liveness: nginx → api-gateway HTTP. */
async function probeGatewayAlive(): Promise<boolean> {
try {
const response = await fetch(`${getApiUrl()}/health`, {
@@ -720,18 +755,22 @@ async function probeGatewayAlive(): Promise<boolean> {
}
async function waitForGatewayAlive(): Promise<void> {
if (gatewayReadyResolved) return;
for (let attempt = 0; attempt < GATEWAY_PROBE_MAX_ATTEMPTS; attempt += 1) {
if (await probeGatewayAlive()) {
gatewayReadyResolved = true;
markApiGatewayReady();
return;
}
if (attempt + 1 < GATEWAY_PROBE_MAX_ATTEMPTS) {
await sleep(GATEWAY_PROBE_DELAY_MS * (attempt + 1));
await sleep(Math.min(GATEWAY_PROBE_BASE_DELAY_MS + attempt * 280, 2800));
}
}
throw new ApiError('Сервер API временно недоступен. Попробуйте обновить страницу.', 503, 'GATEWAY_UNAVAILABLE');
}
/** Один общий прогрев: до 4 проб /health, без бесконечного цикла. */
/** Один общий прогрев: все apiFetch ждут успешный /health, без раннего «fail-open». */
export async function ensureApiGatewayReady(force = false): Promise<void> {
if (typeof window === 'undefined') return;
if (gatewayReadyResolved && !force) return;
@@ -749,7 +788,7 @@ export async function ensureApiGatewayReady(force = false): Promise<void> {
}
function gatewayRetryDelay(attempt: number): number {
return 700 + attempt * 400;
return 800 + attempt * 700;
}
/** Повтор при кратковременном 502/503/504 (nginx не достучался до api-gateway после перезапуска). */
@@ -783,6 +822,8 @@ export async function apiFetch<T>(path: string, options: RequestInit = {}, token
await ensureApiGatewayReady();
}
await acquireApiSlot();
const resolvedToken = resolveAccessToken(token);
const method = (options.method ?? 'GET').toUpperCase();
const hasBody = options.body !== undefined && options.body !== null;
@@ -795,6 +836,7 @@ export async function apiFetch<T>(path: string, options: RequestInit = {}, token
};
let response: Response;
try {
try {
response = await fetchWithGatewayRetry(`${getApiUrl()}${path}`, {
...options,
@@ -818,6 +860,7 @@ export async function apiFetch<T>(path: string, options: RequestInit = {}, token
if (allowRetry && resolvedToken && error.code === 'TOKEN_EXPIRED') {
const refreshed = await trySilentTokenRefresh();
if (refreshed?.accessToken) {
releaseApiSlot();
return apiFetch<T>(path, options, refreshed.accessToken, false);
}
if (refreshed?.requiresPin) {
@@ -830,6 +873,9 @@ export async function apiFetch<T>(path: string, options: RequestInit = {}, token
markApiGatewayReady();
return response.json() as Promise<T>;
} finally {
releaseApiSlot();
}
}
export { getDeviceFingerprint, buildAuthDevicePayload, resolveDeviceLabel, formatUserAgentLabel } from '@/lib/device-client';