@danypops/tickets 0.9.0 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/tickets",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Unified CLI, daemon, and TypeScript library for issue tracking across GitHub, GitLab, and Jira.",
   "type": "module",
   "license": "MIT",

package/src/auth/token-store.ts

@@ -5,9 +5,14 @@
  * *to* GitHub/GitLab/Jira on the user's behalf. Same security posture as
  * vehicle-server's ensureAuthToken: 0700 directory, 0600 files, atomic write.
  */
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { createAtomicJsonWriter } from "@danypops/vehicle-core";
+import { createNodeAtomicJsonFsAdapter } from "@danypops/vehicle-server/atomic-json";
+
+const atomicJson = createAtomicJsonWriter({ fs: createNodeAtomicJsonFsAdapter() });
 
 export interface StoredToken {
   accessToken: string;
@@ -35,21 +40,19 @@ function tokenPath(backend: string, opts: TokenStoreEnv = {}): string {
   return join(tokenStoreDir(opts), `${backend}.json`);
 }
 
-export function saveToken(backend: string, token: StoredToken, opts: TokenStoreEnv = {}): void {
+export async function saveToken(backend: string, token: StoredToken, opts: TokenStoreEnv = {}): Promise<void> {
   const path = tokenPath(backend, opts);
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, `${JSON.stringify(token, null, 2)}\n`, { mode: 0o600 });
-  renameSync(temp, path);
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  await atomicJson.write(path, token, { mode: 0o600, pretty: true, trailingNewline: true });
 }
 
-export function loadToken(backend: string, opts: TokenStoreEnv = {}): StoredToken | undefined {
+export async function loadToken(backend: string, opts: TokenStoreEnv = {}): Promise<StoredToken | undefined> {
   const path = tokenPath(backend, opts);
-  if (!existsSync(path)) return undefined;
-  chmodSync(path, 0o600);
   try {
-    return JSON.parse(readFileSync(path, "utf8")) as StoredToken;
+    return (await atomicJson.read(path)) as StoredToken | undefined;
   } catch {
+    // A corrupt/malformed token file is treated the same as no token --
+    // the caller re-authenticates rather than crashing on a parse error.
     return undefined;
   }
 }

package/src/cli/index.ts

@@ -550,7 +550,7 @@ auth
       if (type === "github" && opts.ghCli !== undefined) {
         const result = await readGhCliToken(opts.ghCli === true ? undefined : opts.ghCli);
         if (!result.ok) throw new Error(result.reason);
-        saveToken(opts.backend, { accessToken: result.token });
+        await saveToken(opts.backend, { accessToken: result.token });
         printJson({
           backend: opts.backend,
           status: "authorized",
@@ -577,7 +577,7 @@ auth
             }
           },
         });
-        saveToken(opts.backend, {
+        await saveToken(opts.backend, {
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt,
@@ -600,7 +600,7 @@ auth
             }
           },
         });
-        saveToken(opts.backend, {
+        await saveToken(opts.backend, {
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt,
@@ -627,7 +627,7 @@ auth
             }
           },
         });
-        saveToken(opts.backend, {
+        await saveToken(opts.backend, {
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt,
@@ -661,7 +661,7 @@ auth
       process.exitCode = 1;
       return;
     }
-    saveToken(backend, { accessToken: value });
+    await saveToken(backend, { accessToken: value });
     printJson({
       backend,
       status: "stored",
@@ -672,18 +672,20 @@ auth
 auth
   .command("status")
   .description("list backends with a locally stored delegated token")
-  .action(() => {
+  .action(async () => {
     const backends = listStoredBackends();
     printJson(
-      backends.map((backend) => {
-        const token = loadToken(backend);
-        return {
-          backend,
-          fresh: token ? isTokenFresh(token) : false,
-          expiresAt: token?.expiresAt ?? null,
-          scope: token?.scope ?? null,
-        };
-      }),
+      await Promise.all(
+        backends.map(async (backend) => {
+          const token = await loadToken(backend);
+          return {
+            backend,
+            fresh: token ? isTokenFresh(token) : false,
+            expiresAt: token?.expiresAt ?? null,
+            scope: token?.scope ?? null,
+          };
+        }),
+      ),
     );
   });
 

package/src/config/config.ts

@@ -103,7 +103,7 @@ export async function preferredAuth(
   const fromEnigma = await tryEnigma(name, { env, token: env.ENIGMA_CLIENT_TOKEN });
   if (fromEnigma) return { token: fromEnigma.accessToken, oauth: true, extra: fromEnigma.extra };
 
-  const stored = loadToken(name, { env });
+  const stored = await loadToken(name, { env });
   if (stored && isTokenFresh(stored)) {
     return { token: stored.accessToken, oauth: true, extra: stored.extra };
   }