Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

widget: session renewal ordering and refresh-margin follow-ups after 0.4.0

Abierto
  • ¿Algo no está bien?
#8 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
authentication, frontend

Línea de trabajo

Start with plans/reports/code-reviewer-261026-2104-webchat-pr6-merge-review.md, then read packages/dewee-webchat/src/widget/api-client.ts around ensureSession, renewSession and loadSession for items 1-3 and 5. For item 4, read handler.ts and its fixed Access-Control-Allow-Headers list. Done means each follow-up is fixed or explicitly justified, with renewal no longer joining a request that began before sign-in and the CORS header list extensible.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Problem

Follow-ups from the isolated review of the merge of main into #6 (custom headers/fetch plus identity sessions, 0.4.0). None of these blocks a release, and none can send another user's token.

  1. M2: renewSession() can return an anonymous session. In packages/dewee-webchat/src/widget/api-client.ts (around ensureSession / renewSession), renewSession() reuses a /session request that is already in flight. If that request started before the host signed the user in, the widget keeps the anonymous session after sign-in. Fix: add a generation counter so that a renewal ignores, and does not join, an older in-flight load.
  2. L6: headers(true) can send the stored anonymous token while a renewal is loading. loadSession sets this.session to the stored anonymous visitor before it creates the new session. A history or link call that is waiting on host headers can therefore send that anonymous token instead of waiting for the signed-in one. The impact is limited to the same browser's own visitor, and renewSession() reloads the conversation. Fix: also wait for an in-progress load, or correct the comment, which currently promises "never none or a stale one".
  3. L1: the anonymous refresh margin mixes clocks. Anonymous sessions have no expiresIn, so freshness compares the server's expiresAt with the browser clock. With a short anonymous TTL and a browser clock that runs ahead, every request mints a new /session (and a Turnstile challenge). Fix: send expiresIn for anonymous sessions too.
  4. L3: CORS cannot be extended. The built-in handler's Access-Control-Allow-Headers list is fixed (handler.ts), so a cross-origin endpoint cannot accept the extra headers the widget now supports.
  5. L4: stale entries stay in storage. A signed-in entry stored by a 0.3.0 widget is ignored but never deleted from localStorage.

Review report (dewee repo): plans/reports/code-reviewer-261026-2104-webchat-pr6-merge-review.md. Part of nextlevelbuilder/dewee#1450.

Lenguaje dominante
TypeScript
Estrellas
7
Forks
1
Merge medio
1 d 6 h
PR fusionados (30 d)
5

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de nextlevelbuilder/dewee-webchat

Todos los issues de nextlevelbuilder/dewee-webchat

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.