From 050a0650173992def473dcc2f81c4ae90d15213a Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:15:09 +0300 Subject: [PATCH 1/7] Add files via upload --- src/utils/token.ts | 151 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) create mode 100644 src/utils/token.ts diff --git a/src/utils/token.ts b/src/utils/token.ts new file mode 100644 index 0000000..d5b0309 --- /dev/null +++ b/src/utils/token.ts @@ -0,0 +1,151 @@ +/** + * Утилиты для безопасной работы с JWT токенами + */ + +const TOKEN_KEYS = { + ACCESS: 'access_token', + REFRESH: 'refresh_token', + USER: 'user', + TELEGRAM_INIT: 'telegram_init_data', +} as const + +interface JWTPayload { + exp?: number + iat?: number + sub?: string + [key: string]: unknown +} + +/** + * Декодирует JWT токен без верификации подписи + * Используется только для чтения payload на клиенте + */ +export function decodeJWT(token: string): JWTPayload | null { + try { + const parts = token.split('.') + if (parts.length !== 3) return null + + const payload = parts[1] + const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/')) + return JSON.parse(decoded) + } catch { + return null + } +} + +/** + * Проверяет, истёк ли срок действия токена + * @param token JWT токен + * @param bufferSeconds Буфер в секундах до истечения (по умолчанию 30 сек) + */ +export function isTokenExpired(token: string | null, bufferSeconds = 30): boolean { + if (!token) return true + + const payload = decodeJWT(token) + if (!payload?.exp) return true + + const now = Math.floor(Date.now() / 1000) + return payload.exp <= now + bufferSeconds +} + +/** + * Проверяет, валиден ли токен (не истёк и корректный формат) + */ +export function isTokenValid(token: string | null): boolean { + if (!token) return false + return !isTokenExpired(token) +} + +/** + * Безопасное хранилище токенов + * Использует sessionStorage вместо localStorage для защиты от XSS + * Токены не сохраняются между сессиями браузера + */ +export const tokenStorage = { + getAccessToken(): string | null { + try { + return sessionStorage.getItem(TOKEN_KEYS.ACCESS) + } catch { + return null + } + }, + + getRefreshToken(): string | null { + try { + return sessionStorage.getItem(TOKEN_KEYS.REFRESH) + } catch { + return null + } + }, + + setTokens(accessToken: string, refreshToken: string): void { + try { + sessionStorage.setItem(TOKEN_KEYS.ACCESS, accessToken) + sessionStorage.setItem(TOKEN_KEYS.REFRESH, refreshToken) + } catch { + console.error('Failed to save tokens to sessionStorage') + } + }, + + setAccessToken(accessToken: string): void { + try { + sessionStorage.setItem(TOKEN_KEYS.ACCESS, accessToken) + } catch { + console.error('Failed to save access token to sessionStorage') + } + }, + + clearTokens(): void { + try { + sessionStorage.removeItem(TOKEN_KEYS.ACCESS) + sessionStorage.removeItem(TOKEN_KEYS.REFRESH) + sessionStorage.removeItem(TOKEN_KEYS.USER) + // Также очищаем localStorage для миграции со старой версии + localStorage.removeItem(TOKEN_KEYS.ACCESS) + localStorage.removeItem(TOKEN_KEYS.REFRESH) + localStorage.removeItem(TOKEN_KEYS.USER) + } catch { + // ignore + } + }, + + /** + * Миграция токенов из localStorage в sessionStorage + * Вызывается при инициализации для обратной совместимости + */ + migrateFromLocalStorage(): void { + try { + const accessToken = localStorage.getItem(TOKEN_KEYS.ACCESS) + const refreshToken = localStorage.getItem(TOKEN_KEYS.REFRESH) + + if (accessToken && !sessionStorage.getItem(TOKEN_KEYS.ACCESS)) { + sessionStorage.setItem(TOKEN_KEYS.ACCESS, accessToken) + } + if (refreshToken && !sessionStorage.getItem(TOKEN_KEYS.REFRESH)) { + sessionStorage.setItem(TOKEN_KEYS.REFRESH, refreshToken) + } + + // Удаляем из localStorage после миграции + localStorage.removeItem(TOKEN_KEYS.ACCESS) + localStorage.removeItem(TOKEN_KEYS.REFRESH) + } catch { + // ignore + } + }, + + getTelegramInitData(): string | null { + try { + return sessionStorage.getItem(TOKEN_KEYS.TELEGRAM_INIT) + } catch { + return null + } + }, + + setTelegramInitData(data: string): void { + try { + sessionStorage.setItem(TOKEN_KEYS.TELEGRAM_INIT, data) + } catch { + // ignore + } + }, +} From 34e74e44c46a72e4aef817e734549eca31c3edb2 Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:15:54 +0300 Subject: [PATCH 2/7] Update client.ts --- src/api/client.ts | 114 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 79 insertions(+), 35 deletions(-) diff --git a/src/api/client.ts b/src/api/client.ts index 9a9221a..40943c8 100644 --- a/src/api/client.ts +++ b/src/api/client.ts @@ -1,27 +1,18 @@ import axios, { AxiosError, InternalAxiosRequestConfig } from 'axios' +import { tokenStorage, isTokenExpired } from '../utils/token' const API_BASE_URL = import.meta.env.VITE_API_URL || '/api' -const TELEGRAM_INIT_STORAGE_KEY = 'telegram_init_data' - const getTelegramInitData = (): string | null => { if (typeof window === 'undefined') return null const initData = window.Telegram?.WebApp?.initData if (initData) { - try { - localStorage.setItem(TELEGRAM_INIT_STORAGE_KEY, initData) - } catch { - /* ignore storage errors */ - } + tokenStorage.setTelegramInitData(initData) return initData } - try { - return localStorage.getItem(TELEGRAM_INIT_STORAGE_KEY) - } catch { - return null - } + return tokenStorage.getTelegramInitData() } export const apiClient = axios.create({ @@ -31,9 +22,64 @@ export const apiClient = axios.create({ }, }) -// Request interceptor - add auth token -apiClient.interceptors.request.use((config: InternalAxiosRequestConfig) => { - const token = localStorage.getItem('access_token') +// Флаг для предотвращения множественных refresh запросов +let isRefreshing = false +let refreshSubscribers: ((token: string) => void)[] = [] + +const subscribeTokenRefresh = (cb: (token: string) => void) => { + refreshSubscribers.push(cb) +} + +const onTokenRefreshed = (token: string) => { + refreshSubscribers.forEach((cb) => cb(token)) + refreshSubscribers = [] +} + +const refreshAccessToken = async (): Promise => { + const refreshToken = tokenStorage.getRefreshToken() + if (!refreshToken) return null + + try { + const response = await axios.post(`${API_BASE_URL}/cabinet/auth/refresh`, { + refresh_token: refreshToken, + }) + + const { access_token } = response.data + tokenStorage.setAccessToken(access_token) + return access_token + } catch { + tokenStorage.clearTokens() + window.location.href = '/login' + return null + } +} + +// Request interceptor - add auth token with expiration check +apiClient.interceptors.request.use(async (config: InternalAxiosRequestConfig) => { + let token = tokenStorage.getAccessToken() + + // Проверяем срок действия токена перед запросом + if (token && isTokenExpired(token)) { + // Токен истёк или скоро истечёт - обновляем + if (!isRefreshing) { + isRefreshing = true + const newToken = await refreshAccessToken() + isRefreshing = false + + if (newToken) { + token = newToken + onTokenRefreshed(newToken) + } else { + return config + } + } else { + // Другой запрос уже обновляет токен - ждём + token = await new Promise((resolve) => { + subscribeTokenRefresh(resolve) + }) + } + } + if (token && config.headers) { config.headers.Authorization = `Bearer ${token}` } @@ -45,38 +91,37 @@ apiClient.interceptors.request.use((config: InternalAxiosRequestConfig) => { return config }) -// Response interceptor - handle 401, refresh token +// Response interceptor - handle 401 as fallback apiClient.interceptors.response.use( (response) => response, async (error: AxiosError) => { const originalRequest = error.config as InternalAxiosRequestConfig & { _retry?: boolean } + // Если получили 401 и ещё не пробовали refresh (на случай если проверка exp не сработала) if (error.response?.status === 401 && !originalRequest._retry) { originalRequest._retry = true - const refreshToken = localStorage.getItem('refresh_token') - if (refreshToken) { - try { - const response = await axios.post(`${API_BASE_URL}/cabinet/auth/refresh`, { - refresh_token: refreshToken, - }) - - const { access_token } = response.data - localStorage.setItem('access_token', access_token) + if (!isRefreshing) { + isRefreshing = true + const newToken = await refreshAccessToken() + isRefreshing = false + if (newToken) { + onTokenRefreshed(newToken) if (originalRequest.headers) { - originalRequest.headers.Authorization = `Bearer ${access_token}` + originalRequest.headers.Authorization = `Bearer ${newToken}` } - return apiClient(originalRequest) - } catch (refreshError) { - // Refresh failed, clear tokens and redirect to login - localStorage.removeItem('access_token') - localStorage.removeItem('refresh_token') - localStorage.removeItem('user') - window.location.href = '/login' - return Promise.reject(refreshError) } + } else { + // Ждём завершения refresh от другого запроса + const token = await new Promise((resolve) => { + subscribeTokenRefresh(resolve) + }) + if (originalRequest.headers) { + originalRequest.headers.Authorization = `Bearer ${token}` + } + return apiClient(originalRequest) } } @@ -85,4 +130,3 @@ apiClient.interceptors.response.use( ) export default apiClient - From 361cad11050a07a72e17f6765a537718d6b17d73 Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:16:26 +0300 Subject: [PATCH 3/7] Update auth.ts --- src/store/auth.ts | 69 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 19 deletions(-) diff --git a/src/store/auth.ts b/src/store/auth.ts index e3c7143..ca2046e 100644 --- a/src/store/auth.ts +++ b/src/store/auth.ts @@ -2,6 +2,7 @@ import { create } from 'zustand' import { persist } from 'zustand/middleware' import type { User } from '../types' import { authApi } from '../api/auth' +import { tokenStorage, isTokenValid } from '../utils/token' export interface TelegramWidgetData { id: number @@ -44,8 +45,7 @@ export const useAuthStore = create()( isAdmin: false, setTokens: (accessToken, refreshToken) => { - localStorage.setItem('access_token', accessToken) - localStorage.setItem('refresh_token', refreshToken) + tokenStorage.setTokens(accessToken, refreshToken) set({ accessToken, refreshToken, @@ -66,8 +66,7 @@ export const useAuthStore = create()( if (refreshToken) { authApi.logout(refreshToken).catch(console.error) } - localStorage.removeItem('access_token') - localStorage.removeItem('refresh_token') + tokenStorage.clearTokens() set({ accessToken: null, refreshToken: null, @@ -79,9 +78,14 @@ export const useAuthStore = create()( checkAdminStatus: async () => { try { + const token = tokenStorage.getAccessToken() + if (!token || !isTokenValid(token)) { + set({ isAdmin: false }) + return + } const response = await fetch('/api/cabinet/auth/me/is-admin', { headers: { - Authorization: `Bearer ${localStorage.getItem('access_token')}`, + Authorization: `Bearer ${token}`, }, }) if (response.ok) { @@ -105,14 +109,47 @@ export const useAuthStore = create()( initialize: async () => { set({ isLoading: true }) - const accessToken = localStorage.getItem('access_token') - const refreshToken = localStorage.getItem('refresh_token') + + // Миграция токенов из localStorage (для обратной совместимости) + tokenStorage.migrateFromLocalStorage() + + const accessToken = tokenStorage.getAccessToken() + const refreshToken = tokenStorage.getRefreshToken() if (!accessToken || !refreshToken) { set({ isLoading: false, isAuthenticated: false }) return } + // Проверяем валидность токена перед использованием + if (!isTokenValid(accessToken)) { + // Токен истёк, пробуем обновить + try { + const response = await authApi.refreshToken(refreshToken) + tokenStorage.setAccessToken(response.access_token) + const user = await authApi.getMe() + set({ + accessToken: response.access_token, + refreshToken, + user, + isAuthenticated: true, + isLoading: false, + }) + get().checkAdminStatus() + return + } catch { + tokenStorage.clearTokens() + set({ + accessToken: null, + refreshToken: null, + user: null, + isAuthenticated: false, + isLoading: false, + }) + return + } + } + try { const user = await authApi.getMe() set({ @@ -122,13 +159,12 @@ export const useAuthStore = create()( isAuthenticated: true, isLoading: false, }) - // Check admin status get().checkAdminStatus() } catch (error) { - // Token might be expired, try to refresh + // Token might be invalid, try to refresh try { const response = await authApi.refreshToken(refreshToken) - localStorage.setItem('access_token', response.access_token) + tokenStorage.setAccessToken(response.access_token) const user = await authApi.getMe() set({ accessToken: response.access_token, @@ -137,12 +173,10 @@ export const useAuthStore = create()( isAuthenticated: true, isLoading: false, }) - // Check admin status get().checkAdminStatus() } catch { // Refresh failed, logout - localStorage.removeItem('access_token') - localStorage.removeItem('refresh_token') + tokenStorage.clearTokens() set({ accessToken: null, refreshToken: null, @@ -156,8 +190,7 @@ export const useAuthStore = create()( loginWithTelegram: async (initData) => { const response = await authApi.loginTelegram(initData) - localStorage.setItem('access_token', response.access_token) - localStorage.setItem('refresh_token', response.refresh_token) + tokenStorage.setTokens(response.access_token, response.refresh_token) set({ accessToken: response.access_token, refreshToken: response.refresh_token, @@ -169,8 +202,7 @@ export const useAuthStore = create()( loginWithTelegramWidget: async (data) => { const response = await authApi.loginTelegramWidget(data) - localStorage.setItem('access_token', response.access_token) - localStorage.setItem('refresh_token', response.refresh_token) + tokenStorage.setTokens(response.access_token, response.refresh_token) set({ accessToken: response.access_token, refreshToken: response.refresh_token, @@ -182,8 +214,7 @@ export const useAuthStore = create()( loginWithEmail: async (email, password) => { const response = await authApi.loginEmail(email, password) - localStorage.setItem('access_token', response.access_token) - localStorage.setItem('refresh_token', response.refresh_token) + tokenStorage.setTokens(response.access_token, response.refresh_token) set({ accessToken: response.access_token, refreshToken: response.refresh_token, From db363b61528e51dd4e50c41829da68ea8c19ef9a Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:20:17 +0300 Subject: [PATCH 4/7] Update auth.ts --- src/store/auth.ts | 185 +++++++++++++++++++++++++++------------------- 1 file changed, 108 insertions(+), 77 deletions(-) diff --git a/src/store/auth.ts b/src/store/auth.ts index ca2046e..e2d4ab4 100644 --- a/src/store/auth.ts +++ b/src/store/auth.ts @@ -2,7 +2,7 @@ import { create } from 'zustand' import { persist } from 'zustand/middleware' import type { User } from '../types' import { authApi } from '../api/auth' -import { tokenStorage, isTokenValid } from '../utils/token' +import { tokenStorage, isTokenValid, tokenRefreshManager } from '../utils/token' export interface TelegramWidgetData { id: number @@ -34,6 +34,10 @@ interface AuthState { loginWithEmail: (email: string, password: string) => Promise } +// Блокировка для предотвращения race condition при инициализации +let initializePromise: Promise | null = null +let isInitializing = false + export const useAuthStore = create()( persist( (set, get) => ({ @@ -64,7 +68,9 @@ export const useAuthStore = create()( logout: () => { const { refreshToken } = get() if (refreshToken) { - authApi.logout(refreshToken).catch(console.error) + authApi.logout(refreshToken).catch((error) => { + console.error('[Auth] Logout API call failed:', error) + }) } tokenStorage.clearTokens() set({ @@ -93,7 +99,7 @@ export const useAuthStore = create()( set({ isAdmin: data.is_admin }) } } catch (error) { - console.error('Failed to check admin status:', error) + console.error('[Auth] Failed to check admin status:', error) set({ isAdmin: false }) } }, @@ -103,89 +109,114 @@ export const useAuthStore = create()( const user = await authApi.getMe() set({ user }) } catch (error) { - console.error('Failed to refresh user:', error) + console.error('[Auth] Failed to refresh user:', error) } }, initialize: async () => { - set({ isLoading: true }) - - // Миграция токенов из localStorage (для обратной совместимости) - tokenStorage.migrateFromLocalStorage() - - const accessToken = tokenStorage.getAccessToken() - const refreshToken = tokenStorage.getRefreshToken() - - if (!accessToken || !refreshToken) { - set({ isLoading: false, isAuthenticated: false }) - return + // Защита от race condition - если уже идёт инициализация, ждём её завершения + if (isInitializing && initializePromise) { + return initializePromise } - // Проверяем валидность токена перед использованием - if (!isTokenValid(accessToken)) { - // Токен истёк, пробуем обновить + isInitializing = true + initializePromise = (async () => { try { - const response = await authApi.refreshToken(refreshToken) - tokenStorage.setAccessToken(response.access_token) - const user = await authApi.getMe() - set({ - accessToken: response.access_token, - refreshToken, - user, - isAuthenticated: true, - isLoading: false, - }) - get().checkAdminStatus() - return - } catch { - tokenStorage.clearTokens() - set({ - accessToken: null, - refreshToken: null, - user: null, - isAuthenticated: false, - isLoading: false, - }) - return - } - } + set({ isLoading: true }) - try { - const user = await authApi.getMe() - set({ - accessToken, - refreshToken, - user, - isAuthenticated: true, - isLoading: false, - }) - get().checkAdminStatus() - } catch (error) { - // Token might be invalid, try to refresh - try { - const response = await authApi.refreshToken(refreshToken) - tokenStorage.setAccessToken(response.access_token) - const user = await authApi.getMe() - set({ - accessToken: response.access_token, - refreshToken, - user, - isAuthenticated: true, - isLoading: false, - }) - get().checkAdminStatus() - } catch { - // Refresh failed, logout - tokenStorage.clearTokens() - set({ - accessToken: null, - refreshToken: null, - user: null, - isAuthenticated: false, - isLoading: false, - }) + // Миграция токенов из localStorage (для обратной совместимости) + tokenStorage.migrateFromLocalStorage() + + const accessToken = tokenStorage.getAccessToken() + const refreshToken = tokenStorage.getRefreshToken() + + if (!accessToken || !refreshToken) { + set({ isLoading: false, isAuthenticated: false }) + return + } + + // Проверяем валидность токена перед использованием + if (!isTokenValid(accessToken)) { + // Используем централизованный менеджер для refresh + const newToken = await tokenRefreshManager.refreshAccessToken() + if (newToken) { + const user = await authApi.getMe() + set({ + accessToken: newToken, + refreshToken, + user, + isAuthenticated: true, + isLoading: false, + }) + get().checkAdminStatus() + } else { + tokenStorage.clearTokens() + set({ + accessToken: null, + refreshToken: null, + user: null, + isAuthenticated: false, + isLoading: false, + }) + } + return + } + + try { + const user = await authApi.getMe() + set({ + accessToken, + refreshToken, + user, + isAuthenticated: true, + isLoading: false, + }) + get().checkAdminStatus() + } catch (error) { + console.error('[Auth] getMe failed, trying refresh:', error) + // Token might be invalid on server, try to refresh + const newToken = await tokenRefreshManager.refreshAccessToken() + if (newToken) { + try { + const user = await authApi.getMe() + set({ + accessToken: newToken, + refreshToken, + user, + isAuthenticated: true, + isLoading: false, + }) + get().checkAdminStatus() + } catch (userError) { + console.error('[Auth] getMe failed after refresh:', userError) + tokenStorage.clearTokens() + set({ + accessToken: null, + refreshToken: null, + user: null, + isAuthenticated: false, + isLoading: false, + }) + } + } else { + // Refresh failed, logout + tokenStorage.clearTokens() + set({ + accessToken: null, + refreshToken: null, + user: null, + isAuthenticated: false, + isLoading: false, + }) + } + } + } finally { + isInitializing = false + initializePromise = null } - } + })() + + return initializePromise }, loginWithTelegram: async (initData) => { From 42d97a4312d0061c941992f91c873471587072bf Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:20:49 +0300 Subject: [PATCH 5/7] Update client.ts --- src/api/client.ts | 86 +++++++++++------------------------------------ 1 file changed, 19 insertions(+), 67 deletions(-) diff --git a/src/api/client.ts b/src/api/client.ts index 40943c8..7788bb7 100644 --- a/src/api/client.ts +++ b/src/api/client.ts @@ -1,8 +1,11 @@ import axios, { AxiosError, InternalAxiosRequestConfig } from 'axios' -import { tokenStorage, isTokenExpired } from '../utils/token' +import { tokenStorage, isTokenExpired, tokenRefreshManager } from '../utils/token' const API_BASE_URL = import.meta.env.VITE_API_URL || '/api' +// Настраиваем endpoint для refresh +tokenRefreshManager.setRefreshEndpoint(`${API_BASE_URL}/cabinet/auth/refresh`) + const getTelegramInitData = (): string | null => { if (typeof window === 'undefined') return null @@ -22,61 +25,21 @@ export const apiClient = axios.create({ }, }) -// Флаг для предотвращения множественных refresh запросов -let isRefreshing = false -let refreshSubscribers: ((token: string) => void)[] = [] - -const subscribeTokenRefresh = (cb: (token: string) => void) => { - refreshSubscribers.push(cb) -} - -const onTokenRefreshed = (token: string) => { - refreshSubscribers.forEach((cb) => cb(token)) - refreshSubscribers = [] -} - -const refreshAccessToken = async (): Promise => { - const refreshToken = tokenStorage.getRefreshToken() - if (!refreshToken) return null - - try { - const response = await axios.post(`${API_BASE_URL}/cabinet/auth/refresh`, { - refresh_token: refreshToken, - }) - - const { access_token } = response.data - tokenStorage.setAccessToken(access_token) - return access_token - } catch { - tokenStorage.clearTokens() - window.location.href = '/login' - return null - } -} - // Request interceptor - add auth token with expiration check apiClient.interceptors.request.use(async (config: InternalAxiosRequestConfig) => { let token = tokenStorage.getAccessToken() // Проверяем срок действия токена перед запросом if (token && isTokenExpired(token)) { - // Токен истёк или скоро истечёт - обновляем - if (!isRefreshing) { - isRefreshing = true - const newToken = await refreshAccessToken() - isRefreshing = false - - if (newToken) { - token = newToken - onTokenRefreshed(newToken) - } else { - return config - } + // Используем централизованный менеджер для refresh + const newToken = await tokenRefreshManager.refreshAccessToken() + if (newToken) { + token = newToken } else { - // Другой запрос уже обновляет токен - ждём - token = await new Promise((resolve) => { - subscribeTokenRefresh(resolve) - }) + // Refresh не удался - редирект на логин + tokenStorage.clearTokens() + window.location.href = '/login' + return config } } @@ -101,27 +64,16 @@ apiClient.interceptors.response.use( if (error.response?.status === 401 && !originalRequest._retry) { originalRequest._retry = true - if (!isRefreshing) { - isRefreshing = true - const newToken = await refreshAccessToken() - isRefreshing = false - - if (newToken) { - onTokenRefreshed(newToken) - if (originalRequest.headers) { - originalRequest.headers.Authorization = `Bearer ${newToken}` - } - return apiClient(originalRequest) - } - } else { - // Ждём завершения refresh от другого запроса - const token = await new Promise((resolve) => { - subscribeTokenRefresh(resolve) - }) + const newToken = await tokenRefreshManager.refreshAccessToken() + if (newToken) { if (originalRequest.headers) { - originalRequest.headers.Authorization = `Bearer ${token}` + originalRequest.headers.Authorization = `Bearer ${newToken}` } return apiClient(originalRequest) + } else { + // Refresh не удался + tokenStorage.clearTokens() + window.location.href = '/login' } } From 20e300587973f55e0392299e49b3c81deb8e2467 Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:21:13 +0300 Subject: [PATCH 6/7] Update token.ts --- src/utils/token.ts | 104 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) diff --git a/src/utils/token.ts b/src/utils/token.ts index d5b0309..7018db9 100644 --- a/src/utils/token.ts +++ b/src/utils/token.ts @@ -149,3 +149,107 @@ export const tokenStorage = { } }, } + +/** + * Централизованный менеджер обновления токенов + * Предотвращает множественные параллельные refresh запросы + */ +class TokenRefreshManager { + private isRefreshing = false + private refreshPromise: Promise | null = null + private subscribers: ((token: string | null) => void)[] = [] + private refreshEndpoint = '/api/cabinet/auth/refresh' + + setRefreshEndpoint(endpoint: string): void { + this.refreshEndpoint = endpoint + } + + /** + * Обновляет access token используя refresh token + * При множественных вызовах возвращает один и тот же Promise + */ + async refreshAccessToken(): Promise { + // Если уже идёт refresh - возвращаем существующий Promise + if (this.isRefreshing && this.refreshPromise) { + return this.refreshPromise + } + + const refreshToken = tokenStorage.getRefreshToken() + if (!refreshToken) { + return null + } + + this.isRefreshing = true + this.refreshPromise = this.doRefresh(refreshToken) + + try { + const result = await this.refreshPromise + this.notifySubscribers(result) + return result + } finally { + this.isRefreshing = false + this.refreshPromise = null + } + } + + private async doRefresh(refreshToken: string): Promise { + try { + const response = await fetch(this.refreshEndpoint, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ refresh_token: refreshToken }), + }) + + if (!response.ok) { + throw new Error(`Refresh failed: ${response.status}`) + } + + const data = await response.json() + const newAccessToken = data.access_token + + if (newAccessToken) { + tokenStorage.setAccessToken(newAccessToken) + return newAccessToken + } + + return null + } catch (error) { + console.error('[TokenRefreshManager] Refresh failed:', error) + return null + } + } + + /** + * Подписка на результат refresh (для ожидающих запросов) + */ + subscribe(callback: (token: string | null) => void): () => void { + this.subscribers.push(callback) + return () => { + this.subscribers = this.subscribers.filter((cb) => cb !== callback) + } + } + + private notifySubscribers(token: string | null): void { + this.subscribers.forEach((cb) => cb(token)) + this.subscribers = [] + } + + /** + * Проверяет, идёт ли сейчас refresh + */ + get isRefreshInProgress(): boolean { + return this.isRefreshing + } + + /** + * Ожидает завершения текущего refresh (если есть) + */ + async waitForRefresh(): Promise { + if (this.refreshPromise) { + return this.refreshPromise + } + return tokenStorage.getAccessToken() + } +} + +export const tokenRefreshManager = new TokenRefreshManager() From 5882c305ef4e9ec14802418d956c78f6dc4cfd9e Mon Sep 17 00:00:00 2001 From: Egor Date: Sun, 18 Jan 2026 05:21:38 +0300 Subject: [PATCH 7/7] Update TopUpModal.tsx --- src/components/TopUpModal.tsx | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/components/TopUpModal.tsx b/src/components/TopUpModal.tsx index d4716d0..2629da2 100644 --- a/src/components/TopUpModal.tsx +++ b/src/components/TopUpModal.tsx @@ -19,7 +19,10 @@ const buildCryptoBotDeepLink = (url: string): string | null => { return `tg://resolve?domain=CryptoBot${parsed.search || ''}` } return null - } catch { return null } + } catch (e) { + console.warn('[TopUpModal] Failed to build CryptoBot deep link:', e) + return null + } } const openPaymentLink = (url: string, reservedWindow?: Window | null) => { @@ -28,7 +31,7 @@ const openPaymentLink = (url: string, reservedWindow?: Window | null) => { // If inside Telegram Mini App, let Telegram handle t.me links if (isTelegramPaymentLink(url) && webApp?.openTelegramLink) { - try { webApp.openTelegramLink(url); return } catch { /* ignore */ } + try { webApp.openTelegramLink(url); return } catch (e) { console.warn('[TopUpModal] openTelegramLink failed:', e) } } // Prefer Telegram deep link specifically for CryptoBot invoices, but only when @@ -37,7 +40,7 @@ const openPaymentLink = (url: string, reservedWindow?: Window | null) => { const target = cb && !isTelegramPaymentLink(url) ? cb : url if (reservedWindow && !reservedWindow.closed) { - try { reservedWindow.location.href = target; reservedWindow.focus?.() } catch { /* ignore */ } + try { reservedWindow.location.href = target; reservedWindow.focus?.() } catch (e) { console.warn('[TopUpModal] Failed to use reserved window:', e) } return } @@ -136,7 +139,7 @@ export default function TopUpModal({ method, onClose }: TopUpModalProps) { onClose() }, onError: (error: unknown) => { - try { if (popupRef.current && !popupRef.current.closed) popupRef.current.close() } catch { /* ignore */ } + try { if (popupRef.current && !popupRef.current.closed) popupRef.current.close() } catch (e) { console.warn('[TopUpModal] Failed to close popup:', e) } popupRef.current = null const detail = (error as { response?: { data?: { detail?: string } } })?.response?.data?.detail || '' if (detail.includes('not yet implemented')) setError(t('balance.useBot'))