From a2a09b5e916677157cbdaa18e263ccd3ace0aa63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Jasi=C5=84ski?= Date: Mon, 18 May 2026 20:07:32 +0200 Subject: [PATCH 1/4] fix(ui): enforce idempotent AI data fetching and JSRuntime guards --- .../Molecules/AiAssistantBubble.razor | 17 ++++++++++++ .../Molecules/GroundednessBadge.razor | 27 ++++++++++++++++++- src/NexusReader.UI.Shared/Pages/Home.razor | 5 ++-- 3 files changed, 46 insertions(+), 3 deletions(-) diff --git a/src/NexusReader.UI.Shared/Components/Molecules/AiAssistantBubble.razor b/src/NexusReader.UI.Shared/Components/Molecules/AiAssistantBubble.razor index 3b4f4ca..ba4a703 100644 --- a/src/NexusReader.UI.Shared/Components/Molecules/AiAssistantBubble.razor +++ b/src/NexusReader.UI.Shared/Components/Molecules/AiAssistantBubble.razor @@ -51,9 +51,13 @@ private string _lastFetchedBlockId = string.Empty; private KnowledgePacket? _packet; private CancellationTokenSource? _streamCts; + private bool _isInteractive; protected override async Task OnParametersSetAsync() { + if (!_isInteractive) + return; + // Only re-fetch when the block context actually changes if (string.IsNullOrEmpty(ContextBlockId) || ContextBlockId == _lastFetchedBlockId) return; @@ -62,6 +66,19 @@ await FetchAndStreamAsync(); } + protected override async Task OnAfterRenderAsync(bool firstRender) + { + if (firstRender) + { + _isInteractive = true; + if (!string.IsNullOrEmpty(ContextBlockId)) + { + _lastFetchedBlockId = ContextBlockId; + await FetchAndStreamAsync(); + } + } + } + private async Task FetchAndStreamAsync() { // Cancel any in-progress stream diff --git a/src/NexusReader.UI.Shared/Components/Molecules/GroundednessBadge.razor b/src/NexusReader.UI.Shared/Components/Molecules/GroundednessBadge.razor index 723b394..79dd733 100644 --- a/src/NexusReader.UI.Shared/Components/Molecules/GroundednessBadge.razor +++ b/src/NexusReader.UI.Shared/Components/Molecules/GroundednessBadge.razor @@ -26,15 +26,40 @@ private GroundednessResult? _result; private bool _isChecking; + private bool _isInteractive; + private string _previousAnswer = string.Empty; + private string _previousContext = string.Empty; + + protected override void OnParametersSet() + { + if (Answer != _previousAnswer || Context != _previousContext) + { + _result = null; + _previousAnswer = Answer; + _previousContext = Context; + } + } protected override async Task OnParametersSetAsync() { - if (!string.IsNullOrEmpty(Answer) && !string.IsNullOrEmpty(Context) && _result == null) + if (_isInteractive && !string.IsNullOrEmpty(Answer) && !string.IsNullOrEmpty(Context) && _result == null) { await RunCheck(); } } + protected override async Task OnAfterRenderAsync(bool firstRender) + { + if (firstRender) + { + _isInteractive = true; + if (!string.IsNullOrEmpty(Answer) && !string.IsNullOrEmpty(Context) && _result == null) + { + await RunCheck(); + } + } + } + private async Task RunCheck() { _isChecking = true; diff --git a/src/NexusReader.UI.Shared/Pages/Home.razor b/src/NexusReader.UI.Shared/Pages/Home.razor index bf31e07..d9d8c3e 100644 --- a/src/NexusReader.UI.Shared/Pages/Home.razor +++ b/src/NexusReader.UI.Shared/Pages/Home.razor @@ -27,11 +27,10 @@ private IJSObjectReference? _keydownHandler; private DotNetObjectReference? _dotNetRef; - protected override async Task OnInitializedAsync() + protected override void OnInitialized() { QuizState.OnQuizRequested += HandleQuizRequestedAsync; FocusMode.OnFocusModeChanged += HandleUpdate; - await FocusMode.InitializeAsync(); } protected override async Task OnParametersSetAsync() @@ -65,11 +64,13 @@ { if (firstRender) { + await FocusMode.InitializeAsync(); try { _interopModule = await JS.InvokeAsync("import", "./_content/NexusReader.UI.Shared/js/focusInterop.js"); _dotNetRef = DotNetObjectReference.Create(this); _keydownHandler = await _interopModule.InvokeAsync("attachKeyboardListener", _dotNetRef); } catch { } /* ignored dynamically */ + StateHasChanged(); } } -- 2.52.0 From 720a5e6091cfe4f955a64963ab94a7bfecd92535 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Jasi=C5=84ski?= Date: Tue, 19 May 2026 19:59:44 +0200 Subject: [PATCH 2/4] fix(infra): use thread-safe Lazy Task for active AI request deduplication --- .../Services/KnowledgeService.cs | 36 ++++++++++++++++--- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/src/NexusReader.Infrastructure/Services/KnowledgeService.cs b/src/NexusReader.Infrastructure/Services/KnowledgeService.cs index 1ada2b1..5bfeda7 100644 --- a/src/NexusReader.Infrastructure/Services/KnowledgeService.cs +++ b/src/NexusReader.Infrastructure/Services/KnowledgeService.cs @@ -31,7 +31,7 @@ public class KnowledgeService : IKnowledgeService private readonly Tokenizer _tokenizer; private readonly ILogger _logger; private const string PromptVersion = "1.3"; - private static readonly ConcurrentDictionary>> _activeRequests = new(); + private static readonly ConcurrentDictionary>>> _activeRequests = new(); public KnowledgeService( IChatClient chatClient, @@ -100,10 +100,38 @@ public class KnowledgeService : IKnowledgeService // Deduplicate concurrent active requests for the exact same hash var requestKey = $"{tenantId}:{hash}:{traceType}"; - var task = _activeRequests.GetOrAdd(requestKey, _ => - ExecuteAiRequestAndCacheAsync(normalizedText, tenantId, systemPrompt, traceType, ebookId, hash)); + + var lazyTask = _activeRequests.GetOrAdd(requestKey, k => + new Lazy>>( + () => ExecuteAiRequestAndCacheAsync(normalizedText, tenantId, systemPrompt, traceType, ebookId, hash), + System.Threading.LazyThreadSafetyMode.ExecutionAndPublication + )); - return await task; + try + { + var result = await lazyTask.Value; + + // If the AI call returned a failure, remove it from the active dictionary + // so subsequent retries have a chance to request the AI again. + if (result.IsFailed) + { + _activeRequests.TryRemove(requestKey, out _); + } + + return result; + } + catch (Exception) + { + // Evict from active dictionary on hard exceptions to ensure system resiliency + _activeRequests.TryRemove(requestKey, out _); + throw; + } + finally + { + // Once a task successfully finishes and persists to the Persistent Database Cache, + // we evict it from RAM (_activeRequests) since future hits will leverage the DB cache. + _activeRequests.TryRemove(requestKey, out _); + } } private async Task> ExecuteAiRequestAndCacheAsync( -- 2.52.0 From 1f48d36d9c89b55500a530c586bcc0a425379352 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Jasi=C5=84ski?= Date: Tue, 19 May 2026 20:14:04 +0200 Subject: [PATCH 3/4] fix(ui): defer secure API call on library page to prevent 401 on server pre-rendering --- .../Services/KnowledgeService.cs | 3 --- src/NexusReader.UI.Shared/Pages/Library.razor | 7 +++++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/NexusReader.Infrastructure/Services/KnowledgeService.cs b/src/NexusReader.Infrastructure/Services/KnowledgeService.cs index 5bfeda7..963eb80 100644 --- a/src/NexusReader.Infrastructure/Services/KnowledgeService.cs +++ b/src/NexusReader.Infrastructure/Services/KnowledgeService.cs @@ -122,14 +122,11 @@ public class KnowledgeService : IKnowledgeService } catch (Exception) { - // Evict from active dictionary on hard exceptions to ensure system resiliency _activeRequests.TryRemove(requestKey, out _); throw; } finally { - // Once a task successfully finishes and persists to the Persistent Database Cache, - // we evict it from RAM (_activeRequests) since future hits will leverage the DB cache. _activeRequests.TryRemove(requestKey, out _); } } diff --git a/src/NexusReader.UI.Shared/Pages/Library.razor b/src/NexusReader.UI.Shared/Pages/Library.razor index bea0640..94d2355 100644 --- a/src/NexusReader.UI.Shared/Pages/Library.razor +++ b/src/NexusReader.UI.Shared/Pages/Library.razor @@ -508,9 +508,12 @@ private bool _isLoading = true; private List? _books; - protected override async Task OnInitializedAsync() + protected override async Task OnAfterRenderAsync(bool firstRender) { - await LoadBooksAsync(); + if (firstRender) + { + await LoadBooksAsync(); + } } private async Task LoadBooksAsync() -- 2.52.0 From dc697a2f990e4e765941de3e4d9beccc85d2ca14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Jasi=C5=84ski?= Date: Tue, 19 May 2026 20:29:27 +0200 Subject: [PATCH 4/4] security(ui): fix token leakage and captive dependency memory leak in auth handler --- .../Handlers/AuthenticationHeaderHandler.cs | 124 +++++++++++++++++- 1 file changed, 117 insertions(+), 7 deletions(-) diff --git a/src/NexusReader.Web.Client/Handlers/AuthenticationHeaderHandler.cs b/src/NexusReader.Web.Client/Handlers/AuthenticationHeaderHandler.cs index 4a37777..ed07ce9 100644 --- a/src/NexusReader.Web.Client/Handlers/AuthenticationHeaderHandler.cs +++ b/src/NexusReader.Web.Client/Handlers/AuthenticationHeaderHandler.cs @@ -1,31 +1,141 @@ using System.Net.Http.Headers; +using System.Threading; +using Microsoft.AspNetCore.Components; using Microsoft.AspNetCore.Components.WebAssembly.Http; +using Microsoft.Extensions.DependencyInjection; using NexusReader.Application.Abstractions.Services; namespace NexusReader.Web.Client.Handlers; +/// +/// A secure HTTP message delegating handler that automatically appends JWT tokens +/// to trusted origin requests and transparently refreshes expired tokens in a thread-safe manner. +/// public class AuthenticationHeaderHandler : DelegatingHandler { private readonly INativeStorageService _storageService; + private readonly IServiceProvider _serviceProvider; private const string TokenKey = "nexus_auth_token"; + private static readonly SemaphoreSlim _refreshSemaphore = new(1, 1); - public AuthenticationHeaderHandler(INativeStorageService storageService) + public AuthenticationHeaderHandler(INativeStorageService storageService, IServiceProvider serviceProvider) { _storageService = storageService; + _serviceProvider = serviceProvider; } protected override async Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) { - // Ensure cookies are sent (needed for InteractiveAuto SSR synchronization) + // Force browser to forward credentials (cookies) for SSR hydration sync request.SetBrowserRequestCredentials(BrowserRequestCredentials.Include); - var tokenResult = await _storageService.GetSecureString(TokenKey); - - if (tokenResult.IsSuccess && !string.IsNullOrEmpty(tokenResult.Value)) + var path = request.RequestUri?.AbsolutePath ?? ""; + bool isAuthEndpoint = path.Contains("identity/login") || + path.Contains("identity/register") || + path.Contains("identity/refresh"); + + // SECURITY FIX (CWE-200): Ensure we only append JWT tokens to local or trusted base origin requests + var navigationManager = _serviceProvider.GetRequiredService(); + bool isTrustedHost = request.RequestUri != null && + (!request.RequestUri.IsAbsoluteUri || + request.RequestUri.ToString().StartsWith(navigationManager.BaseUri, StringComparison.OrdinalIgnoreCase)); + + string? originalToken = null; + + if (!isAuthEndpoint && isTrustedHost) { - request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokenResult.Value); + var tokenResult = await _storageService.GetSecureString(TokenKey); + if (tokenResult.IsSuccess && !string.IsNullOrEmpty(tokenResult.Value)) + { + originalToken = tokenResult.Value; + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", originalToken); + } } - return await base.SendAsync(request, cancellationToken); + var response = await base.SendAsync(request, cancellationToken); + + // Transparent JWT Auto-Refresh on 401 Unauthorized + if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized && !isAuthEndpoint) + { + await _refreshSemaphore.WaitAsync(cancellationToken); + try + { + // Re-read token to verify if another concurrent request already refreshed it + var tokenResult = await _storageService.GetSecureString(TokenKey); + var currentToken = tokenResult.IsSuccess ? tokenResult.Value : null; + + bool refreshed = false; + + if (!string.IsNullOrEmpty(currentToken) && currentToken != originalToken) + { + refreshed = true; + } + else + { + // SECURITY FIX (CWE-400): Resolve scoped services within an explicit using scope to prevent memory leaks + using var scope = _serviceProvider.CreateScope(); + var identityService = scope.ServiceProvider.GetRequiredService(); + var refreshResult = await identityService.RefreshTokenAsync(); + if (refreshResult.IsSuccess) + { + var newTokenResult = await _storageService.GetSecureString(TokenKey); + currentToken = newTokenResult.IsSuccess ? newTokenResult.Value : null; + refreshed = !string.IsNullOrEmpty(currentToken); + } + else + { + await identityService.LogoutAsync(); + } + } + + if (refreshed && !string.IsNullOrEmpty(currentToken)) + { + var newRequest = await CloneHttpRequestMessageAsync(request); + newRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", currentToken); + return await base.SendAsync(newRequest, cancellationToken); + } + } + catch (Exception ex) + { + // Write standard security audit safe debug log + Console.WriteLine($"[AuthHeaderHandler] Automated token renewal failed: {ex.Message}"); + } + finally + { + _refreshSemaphore.Release(); + } + } + + return response; + } + + private async Task CloneHttpRequestMessageAsync(HttpRequestMessage req) + { + var clone = new HttpRequestMessage(req.Method, req.RequestUri) + { + Version = req.Version + }; + + if (req.Content != null) + { + var ms = new System.IO.MemoryStream(); + await req.Content.CopyToAsync(ms); + ms.Position = 0; + clone.Content = new StreamContent(ms); + + foreach (var h in req.Content.Headers) + { + clone.Content.Headers.TryAddWithoutValidation(h.Key, h.Value); + } + } + + foreach (var h in req.Headers) + { + clone.Headers.TryAddWithoutValidation(h.Key, h.Value); + } + + clone.SetBrowserRequestCredentials(BrowserRequestCredentials.Include); + + return clone; } } -- 2.52.0