@aiam/ciba 0.8.7 → 0.8.8

package/ciba.mjs

@@ -438,83 +438,71 @@ function startDaemon(provider, deviceDoc, privateKey, serverUrl) {
           dlog(`${req.command} cmd attrs=${JSON.stringify(req.attrs)}`);
           const requests = deviceDoc.getMap('requests');
           const resourcesMap = deviceDoc.getMap('resources');
-
-          // Pass attrs straight through — server resolves grant_type from resource URN.
-          const attrs = { ...(req.attrs || {}) };
           const defaultResource = `urn:sap:destination:${process.env.CIBA_DEFAULT_DESTINATION || 'WEBAGENTS_BACKEND'}`;
+          const attrs = { ...(req.attrs || {}) };
           const requestedResource = attrs.resource ?? defaultResource;
 
-          const decryptFromTokenMap = (tokenMap) => {
-            const ciphertext = tokenMap.get('ciphertext');
-            const serverPublicKey = tokenMap.get('serverPublicKey');
-            if (!ciphertext || !serverPublicKey) return null;
-            const plain = ecdhDecrypt(ciphertext, serverPublicKey, privateKey);
-            try { const parsed = JSON.parse(plain); return parsed.access_token ?? plain; }
+          // Pure: check resources map right now, return token map or null.
+          function tryGet(resource) {
+            const key = resource
+              ? resourcesMap.get(resource)
+              : [...resourcesMap.values()][0];
+            if (!key) return null;
+            const map = deviceDoc.getMap(key);
+            const expiresAt = map.get('expires_at');
+            if (expiresAt && expiresAt < Date.now()) return null; // expired
+            if (!map.get('ciphertext')) return null;
+            return map;
+          }
+
+          // Pure: decrypt token map → access_token string.
+          function decrypt(map) {
+            const plain = ecdhDecrypt(map.get('ciphertext'), map.get('serverPublicKey'), privateKey);
+            try { return JSON.parse(plain).access_token ?? plain; }
             catch { return plain; }
-          };
+          }
 
           if (req.command === 'refresh') {
-            // Fire-and-forget — just set default resource if none given.
+            // Fire-and-forget — write request, server exchanges async.
             if (!attrs.resource) attrs.resource = defaultResource;
             const newRid = randomBytes(8).toString('base64url');
-            dlog(`refresh; writing requests[${newRid}] attrs=${JSON.stringify(attrs)}`);
+            dlog(`refresh; writing requests[${newRid}] resource=${attrs.resource}`);
             requests.set(newRid, { ...attrs, status: 'pending', created_at: new Date().toISOString() });
             conn.end(JSON.stringify({ ok: true }));
             return;
           }
 
-          // token: cache-first, then wait for server response
-          const cachedName = resourcesMap.get(requestedResource);
-          if (cachedName) {
-            const cachedMap = deviceDoc.getMap(cachedName);
-            const exp = cachedMap.get('exp');
-            const now = Math.floor(Date.now() / 1000);
-            // Return cached token if: no exp set (server manages expiry),
-            // or exp is still valid. Only skip if we know it's expired.
-            const isExpired = exp && exp < now + 60;
-            if (!isExpired) {
-              const token = decryptFromTokenMap(cachedMap);
-              if (token) { conn.end(JSON.stringify({ token })); return; }
-            }
-          }
+          // token: observe resources map, resolve when token arrives.
+          const waitForResource = (resource) => new Promise((resolve, reject) => {
+            const found = tryGet(resource);
+            if (found) return resolve(found);
 
-          const prevTokenMapName = resourcesMap.get(requestedResource);
-          const newRid = randomBytes(8).toString('base64url');
-          dlog(`cache miss; writing requests[${newRid}] attrs=${JSON.stringify(attrs)} resources=${JSON.stringify([...resourcesMap.entries()])}`);
-          requests.set(newRid, { ...attrs, status: 'pending', created_at: new Date().toISOString() });
-
-          // Immediate re-check: token may have landed between cache check and now.
-          const postWriteName = resourcesMap.get(requestedResource);
-          if (postWriteName && postWriteName !== prevTokenMapName) {
-            const m = deviceDoc.getMap(postWriteName);
-            const token = decryptFromTokenMap(m);
-            if (token) { conn.end(JSON.stringify({ token })); return; }
-          }
-          const newTokenMap = deviceDoc.getMap(`token:${newRid}`);
-
-          const viaRid = firstInYMap(newTokenMap, (key) => key === 'ciphertext' || key === 'error', 30_000)
-            .then(() => newTokenMap);
-
-          const viaResources = firstInYMap(
-            resourcesMap,
-            (key, val) => key === requestedResource && val && val !== prevTokenMapName,
-            30_000
-          ).then((newMapName) => {
-            const m = deviceDoc.getMap(newMapName);
-            return firstInYMap(m, (key) => key === 'ciphertext' || key === 'error', 5_000)
-              .then(() => m).catch(() => m);
+            // Cache miss — write request to trigger server exchange.
+            const newRid = randomBytes(8).toString('base64url');
+            dlog(`cache miss; writing requests[${newRid}] resource=${resource}`);
+            requests.set(newRid, { ...attrs, resource, status: 'pending', created_at: new Date().toISOString() });
+
+            const timer = setTimeout(() => {
+              resourcesMap.unobserve(observer);
+              reject(new Error('Timeout waiting for token'));
+            }, 30_000);
+
+            const observer = () => {
+              const found = tryGet(resource);
+              if (found) {
+                clearTimeout(timer);
+                resourcesMap.unobserve(observer);
+                resolve(found);
+              }
+            };
+            resourcesMap.observe(observer);
           });
 
-          Promise.race([
-            viaRid.then((map) => ({ src: 'rid', map })),
-            viaResources.then((map) => ({ src: 'resources', map })),
-          ])
-            .then(({ src, map }) => {
-              dlog(`token resolved via ${src} for ${requestedResource}`);
-              const err = map.get('error');
-              if (err) { conn.end(JSON.stringify({ error: err })); return; }
-              try { conn.end(JSON.stringify({ token: decryptFromTokenMap(map) })); }
-              catch (e) { conn.end(JSON.stringify({ error: `decrypt failed: ${e.message}` })); }
+          waitForResource(requestedResource)
+            .then((map) => {
+              dlog(`token resolved for ${requestedResource}`);
+              const access_token = decrypt(map);
+              conn.end(JSON.stringify({ token: access_token }));
             })
             .catch((e) => conn.end(JSON.stringify({ error: e.message || 'Timeout waiting for token' })));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiam/ciba",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "description": "OAuth 2.0 Device Authorization Grant CLI with cross-device push approval (Yjs sync, ECDH-encrypted token delivery, persistent device id)",
   "type": "module",
   "bin": {