Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

widget: session renewal ordering and refresh-margin follow-ups after 0.4.0

Aperta
  • Qualcosa non va?
#8 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, frontend

Direzione di ricerca

Start with plans/reports/code-reviewer-261026-2104-webchat-pr6-merge-review.md, then read packages/dewee-webchat/src/widget/api-client.ts around ensureSession, renewSession and loadSession for items 1-3 and 5. For item 4, read handler.ts and its fixed Access-Control-Allow-Headers list. Done means each follow-up is fixed or explicitly justified, with renewal no longer joining a request that began before sign-in and the CORS header list extensible.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

Follow-ups from the isolated review of the merge of main into #6 (custom headers/fetch plus identity sessions, 0.4.0). None of these blocks a release, and none can send another user's token.

  1. M2: renewSession() can return an anonymous session. In packages/dewee-webchat/src/widget/api-client.ts (around ensureSession / renewSession), renewSession() reuses a /session request that is already in flight. If that request started before the host signed the user in, the widget keeps the anonymous session after sign-in. Fix: add a generation counter so that a renewal ignores, and does not join, an older in-flight load.
  2. L6: headers(true) can send the stored anonymous token while a renewal is loading. loadSession sets this.session to the stored anonymous visitor before it creates the new session. A history or link call that is waiting on host headers can therefore send that anonymous token instead of waiting for the signed-in one. The impact is limited to the same browser's own visitor, and renewSession() reloads the conversation. Fix: also wait for an in-progress load, or correct the comment, which currently promises "never none or a stale one".
  3. L1: the anonymous refresh margin mixes clocks. Anonymous sessions have no expiresIn, so freshness compares the server's expiresAt with the browser clock. With a short anonymous TTL and a browser clock that runs ahead, every request mints a new /session (and a Turnstile challenge). Fix: send expiresIn for anonymous sessions too.
  4. L3: CORS cannot be extended. The built-in handler's Access-Control-Allow-Headers list is fixed (handler.ts), so a cross-origin endpoint cannot accept the extra headers the widget now supports.
  5. L4: stale entries stay in storage. A signed-in entry stored by a 0.3.0 widget is ignored but never deleted from localStorage.

Review report (dewee repo): plans/reports/code-reviewer-261026-2104-webchat-pr6-merge-review.md. Part of nextlevelbuilder/dewee#1450.

Lingua principale
TypeScript
Stelle
7
Fork
1
Merge medio
1g 6h
PR unite (30g)
5

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextlevelbuilder/dewee-webchat

Tutte le issue di nextlevelbuilder/dewee-webchat

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.