Bound auth upstream waits and preserve sessions during outages

src/auth.ts

@@ -67,6 +67,8 @@ export async function authenticatedUser(req: Request, res: Response): Promise<{
   if (accessToken) {
     const { data, error } = await verifyAccess(accessToken);
     if (data.user && !error) return { user: data.user };
+    // An outage is not evidence that credentials expired. Do not rotate or clear cookies.
+    if (error && ![400, 401, 403].includes(error.status ?? 0)) throw error;
   }
 
   if (!refreshToken) {
@@ -74,6 +76,7 @@ export async function authenticatedUser(req: Request, res: Response): Promise<{
     return null;
   }
   const { data, error } = await refreshAccess(refreshToken);
+  if (error && ![400, 401, 403].includes(error.status ?? 0)) throw error;
   if (error || !data.user || !data.session) {
     clearSessionCookies(res);
     return null;

src/request-timing.ts

@@ -17,6 +17,13 @@ export const timedFetch: typeof fetch = async (input, init) => {
   }
 };
 
+// Bound identity-service stalls so a shared token check cannot stay pending forever.
+export const timedAuthFetch: typeof fetch = (input, init) => {
+  const deadline = AbortSignal.timeout(8_000);
+  const signal = init?.signal ?? (input instanceof Request ? input.signal : undefined);
+  return timedFetch(input, { ...init, signal: signal ? AbortSignal.any([signal, deadline]) : deadline });
+};
+
 export const requestTiming: RequestHandler = (req, res, next) => {
   const timing = { upstreamMs: 0, calls: 0 };
   const started = performance.now();

src/supabase.ts

@@ -3,7 +3,7 @@ import bcrypt from "bcryptjs";
 import { randomBytes } from "node:crypto";
 import type { Request, Response } from "express";
 import { env, isProduction } from "./config.js";
-import { timedFetch } from "./request-timing.js";
+import { timedFetch, timedAuthFetch } from "./request-timing.js";
 
 // Bind Google's PKCE verifier to the initiating browser, not a shared client's
 // in-memory store (which concurrent logins can overwrite or a restart can lose).
@@ -11,7 +11,7 @@ export function oauthClient(req: Request, res: Response) {
   const cookieName = "sp_oauth_verifier";
   const options = { httpOnly: true, secure: isProduction, sameSite: "lax" as const, path: "/api/auth" };
   return createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
-    global: { fetch: timedFetch },
+    global: { fetch: timedAuthFetch },
     auth: {
       autoRefreshToken: false, persistSession: true, detectSessionInUrl: false, flowType: "pkce",
       storage: {
@@ -28,7 +28,7 @@ export function oauthClient(req: Request, res: Response) {
 }
 
 export const supabaseAuth = createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
-  global: { fetch: timedFetch },
+  global: { fetch: timedAuthFetch },
   // OAuth returns a one-time code for the backend callback to exchange, rather
   // than placing session tokens in the browser URL fragment.
   auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false, flowType: "pkce" },

tests/workspace-performance.test.ts

@@ -13,6 +13,7 @@ test("optimized workspace reads preserve authorization, scores and fresh permiss
   const calls: { method: string; url: URL }[] = [];
   let role = "user";
   let revoked = false;
+  let authUnavailable = false;
   let failActions = false;
   const user = { id: owner, email: "test@example.com", email_confirmed_at: new Date().toISOString(), user_metadata: {} };
   const plan = { subscription_id: "plan", plan: "Pro", price: 10, player_limit: 5, session_limit: 10 };
@@ -31,6 +32,7 @@ test("optimized workspace reads preserve authorization, scores and fresh permiss
     calls.push({ method: req.method!, url });
     res.setHeader("Content-Type", "application/json");
     if (url.pathname === "/auth/v1/user") {
+      if (authUnavailable) { res.statusCode = 503; return res.end(JSON.stringify({ message: "Temporarily unavailable" })); }
       res.statusCode = revoked ? 401 : 200;
       return res.end(JSON.stringify(revoked ? { message: "Revoked" } : user));
     }
@@ -81,6 +83,12 @@ test("optimized workspace reads preserve authorization, scores and fresh permiss
       ...init, signal: AbortSignal.timeout(10000), headers: { Cookie: "sp_access=access", Origin: origin, ...init.headers },
     }).catch((error) => { throw new Error(`Request failed: ${path}`, { cause: error }); });
     assert.equal((await fetch(`${origin}/api/players-overview`)).status, 401);
+    authUnavailable = true;
+    const outage = await request("/api/auth/me", { headers: { Cookie: "sp_access=access; sp_refresh=refresh" } });
+    assert.equal(outage.status, 500);
+    assert.equal(outage.headers.get("set-cookie"), null, "an outage must preserve session cookies");
+    assert.equal(calls.some((call) => call.url.pathname === "/auth/v1/token"), false, "an outage must not rotate refresh tokens");
+    authUnavailable = false;
     const meStart = calls.length;
     const me = await (await request("/api/auth/me")).json();
     assert.equal(me.access.active, true);