@avakado.ai/schemas 1.1.14 → 1.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avakado.ai/schemas",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "description": "Canonical Mongo schemas, models, enums and index declarations shared by the Avakado services.",
   "license": "UNLICENSED",
   "type": "module",

package/src/models/apiAuthenticator.js

@@ -140,8 +140,16 @@ ApiAuthenticationSchema.methods._resolveProvider = async function () {
 ApiAuthenticationSchema.methods._plain = function (value) {
     return value?.toObject?.() ?? value ?? {};
 };
+ApiAuthenticationSchema.methods._tokenFields = function (value) {
+    const plain = { ...this._plain(value) };
+    const nested = this._plain(plain.credentials);
+    const nestedIsToken = Boolean(nested && (nested.accessToken || nested.refreshToken || nested.apiToken || nested.basicToken));
+    if (!nestedIsToken) return plain;
+    delete plain.credentials;
+    return { ...plain, ...nested };
+};
 ApiAuthenticationSchema.methods._enrichedCredentials = function () {
-    const creds = { ...this._plain(this.credentials) };
+    const creds = this._tokenFields(this.credentials);
     const config = this._plain(this.config);
     if (this.authType === "apiKey") {
         creds.accountSid ??= config.AccountSid;
@@ -166,7 +174,8 @@ ApiAuthenticationSchema.methods.refreshToken = async function () {
     }
     const newTokensRes = await serviceProvider.refreshToken(this._enrichedCredentials());
     if (!newTokensRes.success) throw new Error(newTokensRes.error.message);
-    this.credentials = { ...this.credentials, ...newTokensRes.data };
+    this.credentials = { ...this._enrichedCredentials(), ...this._tokenFields(newTokensRes.data) };
+    this.markModified("credentials");
     await this.save();
     return this;
 };
@@ -174,11 +183,19 @@ ApiAuthenticationSchema.methods.ensureValidToken = async function () {
     const serviceProvider = await this._resolveProvider();
     const providerSupportsRefresh = requireDep("providerSupportsRefresh", "ApiAuthenticators.ensureValidToken");
 
-    if (this._isAccessTokenFresh()) return this;
+    if (this._plain(this.credentials).credentials) {
+        this.credentials = this._enrichedCredentials();
+        this.markModified("credentials");
+        await this.save();
+    }
+
+    const canRefresh = providerSupportsRefresh(serviceProvider);
+    const expiresAt = this._enrichedCredentials().expiresAt;
+    if (expiresAt && !this._isAccessTokenFresh() && canRefresh) return this.refreshToken();
 
-    if (await serviceProvider.validateToken(this.credentials)) return this;
+    if (await serviceProvider.validateToken(this._enrichedCredentials())) return this;
 
-    if (!providerSupportsRefresh(serviceProvider)) {
+    if (!canRefresh) {
         throw new Error(`Invalid or expired credentials for ${this.provider.name}; re-authentication required`);
     }