Only return refresh tokens if modified

Before the refresh token was always returned if the access token was
modified. But since they can be modified independently of each other we
should also check that.

Author: mvantellingen

.changeset/eight-clouds-sleep.md

@@ -0,0 +1,5 @@
+---
+"@labdigital/federated-token": minor
+---
+
+Only return refresh tokens if modified

src/gateway.test.ts

@@ -19,6 +19,7 @@ describe("GatewayAuthPlugin", () => {
 	const typeDefs = `#graphql
  			type Query {
     		testToken(create: Boolean): String!
+    		refreshToken: String!
   		}
 	`;
 	const resolvers = {
@@ -33,9 +34,20 @@ describe("GatewayAuthPlugin", () => {
 						token: "bar",
 						exp: Date.now() + 1000,
 					});
+					context.federatedToken?.setRefreshToken("foo", "bar");
 				}
 				return JSON.stringify(context.federatedToken);
 			},
+			refreshToken: (
+				_: any,
+				context: PublicFederatedTokenContext
+			) => {
+				context.federatedToken?.setAccessToken("foo", {
+					token: "bar",
+					exp: Date.now() + 1000,
+				});
+				return JSON.stringify(context.federatedToken);
+			},
 		},
 	};
 

src/gateway.ts

@@ -46,7 +46,7 @@ export class GatewayAuthPlugin<TContext extends PublicFederatedTokenContext>
 			}
 		}
 
-		const rt = request.http?.headers.get("x-refresh-token")
+		const rt = request.http?.headers.get("x-refresh-token");
 		if (rt) {
 			await contextValue.federatedToken?.loadRefreshJWT(this.signer, rt);
 		}
@@ -58,17 +58,18 @@ export class GatewayAuthPlugin<TContext extends PublicFederatedTokenContext>
 		const { contextValue, response } = requestContext;
 		const token = contextValue?.federatedToken;
 
-		if (!token?.isModified()) {
-			return;
-		}
-		const accessToken = await token.createAccessJWT(this.signer);
-		if (accessToken) {
-			response.http.headers.set("X-Access-Token", accessToken);
+		if (token?.isAccessTokenModified()) {
+			const accessToken = await token.createAccessJWT(this.signer);
+			if (accessToken) {
+				response.http.headers.set("X-Access-Token", accessToken);
+			}
 		}
 
-		const refreshToken = await token.createRefreshJWT(this.signer);
-		if (refreshToken) {
-			response.http.headers.set("X-Refresh-Token", refreshToken);
+		if (token?.isRefreshTokenModified()) {
+			const refreshToken = await token.createRefreshJWT(this.signer);
+			if (refreshToken) {
+				response.http.headers.set("X-Refresh-Token", refreshToken);
+			}
 		}
 	}
 }

src/plugin.ts

@@ -40,14 +40,14 @@ export class FederatedAuthPlugin<TContext extends FederatedTokenContext>
 
 		const t = contextValue.federatedToken;
 
-		if (t.isModified()) {
+		if (t.isAccessTokenModified()) {
 			const val = t.dumpAccessToken();
 			if (val) {
 				response.http.headers.set("X-Access-Token", val);
 			}
 		}
 
-		if (t.refreshTokens) {
+		if (t.isRefreshTokenModified()) {
 			const val = t.dumpRefreshToken();
 			if (val) {
 				response.http.headers.set("X-Refresh-Token", val);

src/token.test.ts

@@ -11,7 +11,7 @@ describe("FederatedToken", () => {
     };
     federatedToken.setAccessToken("exampleName", token);
     assert.equal(federatedToken.tokens.exampleName, token);
-    assert.isTrue(federatedToken.isModified());
+    assert.isTrue(federatedToken.isAccessTokenModified());
   });
 
   test("setRefreshToken", () => {
@@ -20,14 +20,14 @@ describe("FederatedToken", () => {
     assert.equal(federatedToken.refreshTokens.exampleName, "exampleToken");
   });
 
-  test("isModified", () => {
+  test("isAccessTokenModified", () => {
 		const federatedToken = new FederatedToken();
-    assert.isFalse(federatedToken.isModified());
+    assert.isFalse(federatedToken.isAccessTokenModified());
     federatedToken.setAccessToken("exampleName", {
       token: "exampleToken",
       exp: 1234567890,
     });
-    assert.isTrue(federatedToken.isModified());
+    assert.isTrue(federatedToken.isAccessTokenModified());
   });
 
   test("loadAccessToken", () => {
@@ -66,7 +66,7 @@ describe("FederatedToken", () => {
     );
 
     assert.isFalse(
-      federatedToken.isModified(),
+      federatedToken.isAccessTokenModified(),
       "isModified should be false when trackModified is false and token is modified"
     );
   });
@@ -107,7 +107,7 @@ describe("FederatedToken", () => {
     );
 
     assert.isTrue(
-      federatedToken.isModified(),
+      federatedToken.isAccessTokenModified(),
       "isModified should be true when trackModified is true and token is modified"
     );
   });

src/token.ts

@@ -15,26 +15,33 @@ export class FederatedToken {
 	refreshTokens: Record<string, string>;
 	values: Record<string, any>;
 
-	private _modified: boolean;
+	private _accessTokenModified: boolean;
+	private _refreshTokenModified: boolean;
 
 	constructor() {
 		this.tokens = {};
 		this.refreshTokens = {};
 		this.values = {};
-		this._modified = false;
+		this._accessTokenModified = false;
+		this._refreshTokenModified = false;
 	}
 
 	setAccessToken(name: string, token: AccessToken) {
 		this.tokens[name] = token;
-		this._modified = true;
+		this._accessTokenModified = true;
 	}
 
 	setRefreshToken(name: string, token: string) {
 		this.refreshTokens[name] = token;
+		this._refreshTokenModified = true;
 	}
 
-	isModified() {
-		return this._modified;
+	isAccessTokenModified() {
+		return this._accessTokenModified;
+	}
+
+	isRefreshTokenModified() {
+		return this._refreshTokenModified;
 	}
 
 	loadAccessToken(at: string, trackModified = false) {
@@ -49,7 +56,7 @@ export class FederatedToken {
 		// Merge tokens into this object
 		for (const k in token.tokens) {
 			if (trackModified && !isEqual(this.tokens[k], token.tokens[k])) {
-				this._modified = true;
+				this._accessTokenModified = true;
 			}
 
 			this.tokens[k] = token.tokens[k];
@@ -76,7 +83,7 @@ export class FederatedToken {
 	}
 
 
-	loadRefreshToken(value: string) {
+	loadRefreshToken(value: string, trackModified = false) {
 		const refreshTokens: Record<string, string> = JSON.parse(
 			Buffer.from(value, "base64").toString("ascii")
 		);
@@ -86,6 +93,10 @@ export class FederatedToken {
 		// Merge tokens in object
 		for (const k in refreshTokens) {
 			this.refreshTokens[k] = refreshTokens[k];
+
+			if (trackModified && !isEqual(this.refreshTokens[k], refreshTokens[k])) {
+				this._refreshTokenModified = true;
+			}
 		}
 	}