@aiam/ciba 0.8.5 → 0.8.7

package/ciba.mjs

@@ -439,22 +439,10 @@ function startDaemon(provider, deviceDoc, privateKey, serverUrl) {
           const requests = deviceDoc.getMap('requests');
           const resourcesMap = deviceDoc.getMap('resources');
 
+          // Pass attrs straight through — server resolves grant_type from resource URN.
           const attrs = { ...(req.attrs || {}) };
-          const resourceUrn = attrs.resource;
-          if (!attrs.grant_type && typeof resourceUrn === 'string') {
-            if (resourceUrn.startsWith('urn:sap:destination:')) {
-              attrs.grant_type = 'urn:sap:destination';
-              if (!attrs.destination) attrs.destination = resourceUrn.slice('urn:sap:destination:'.length);
-            } else if (resourceUrn.startsWith('urn:sap:identity:') || resourceUrn.startsWith('urn:ietf:params:oauth:resource:')) {
-              attrs.grant_type = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
-            }
-          }
-
           const defaultResource = `urn:sap:destination:${process.env.CIBA_DEFAULT_DESTINATION || 'WEBAGENTS_BACKEND'}`;
-          const requestedResource =
-            attrs.grant_type === 'urn:sap:destination' && attrs.destination
-              ? `urn:sap:destination:${attrs.destination}`
-              : attrs.resource ?? defaultResource;
+          const requestedResource = attrs.resource ?? defaultResource;
 
           const decryptFromTokenMap = (tokenMap) => {
             const ciphertext = tokenMap.get('ciphertext');
@@ -466,14 +454,8 @@ function startDaemon(provider, deviceDoc, privateKey, serverUrl) {
           };
 
           if (req.command === 'refresh') {
-            // Fire-and-forget: write the request, return immediately.
-            // Server exchanges async; result lands on device doc via Yjs.
-            // Default to the same resource as `ciba token` when none specified.
-            if (!attrs.grant_type && !attrs.resource && !attrs.destination) {
-              attrs.resource = `urn:sap:destination:${process.env.CIBA_DEFAULT_DESTINATION || 'WEBAGENTS_BACKEND'}`;
-              attrs.grant_type = 'urn:sap:destination';
-              attrs.destination = process.env.CIBA_DEFAULT_DESTINATION || 'WEBAGENTS_BACKEND';
-            }
+            // Fire-and-forget — just set default resource if none given.
+            if (!attrs.resource) attrs.resource = defaultResource;
             const newRid = randomBytes(8).toString('base64url');
             dlog(`refresh; writing requests[${newRid}] attrs=${JSON.stringify(attrs)}`);
             requests.set(newRid, { ...attrs, status: 'pending', created_at: new Date().toISOString() });
@@ -486,18 +468,28 @@ function startDaemon(provider, deviceDoc, privateKey, serverUrl) {
           if (cachedName) {
             const cachedMap = deviceDoc.getMap(cachedName);
             const exp = cachedMap.get('exp');
-            if (exp && exp > Math.floor(Date.now() / 1000) + 60) {
+            const now = Math.floor(Date.now() / 1000);
+            // Return cached token if: no exp set (server manages expiry),
+            // or exp is still valid. Only skip if we know it's expired.
+            const isExpired = exp && exp < now + 60;
+            if (!isExpired) {
               const token = decryptFromTokenMap(cachedMap);
               if (token) { conn.end(JSON.stringify({ token })); return; }
             }
           }
 
+          const prevTokenMapName = resourcesMap.get(requestedResource);
           const newRid = randomBytes(8).toString('base64url');
-          dlog(`cache miss; writing requests[${newRid}] attrs=${JSON.stringify(attrs)}`);
+          dlog(`cache miss; writing requests[${newRid}] attrs=${JSON.stringify(attrs)} resources=${JSON.stringify([...resourcesMap.entries()])}`);
           requests.set(newRid, { ...attrs, status: 'pending', created_at: new Date().toISOString() });
 
-          dlog(`resources map: ${JSON.stringify([...resourcesMap.entries()])} requested=${requestedResource}`);
-          const prevTokenMapName = resourcesMap.get(requestedResource);
+          // Immediate re-check: token may have landed between cache check and now.
+          const postWriteName = resourcesMap.get(requestedResource);
+          if (postWriteName && postWriteName !== prevTokenMapName) {
+            const m = deviceDoc.getMap(postWriteName);
+            const token = decryptFromTokenMap(m);
+            if (token) { conn.end(JSON.stringify({ token })); return; }
+          }
           const newTokenMap = deviceDoc.getMap(`token:${newRid}`);
 
           const viaRid = firstInYMap(newTokenMap, (key) => key === 'ciphertext' || key === 'error', 30_000)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiam/ciba",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "OAuth 2.0 Device Authorization Grant CLI with cross-device push approval (Yjs sync, ECDH-encrypted token delivery, persistent device id)",
   "type": "module",
   "bin": {