@doubling/compound-sync 1.6.0 → 1.7.0

package/auth-persistence.js

@@ -0,0 +1,79 @@
+// File-backed Firebase Auth persistence for Node.
+//
+// Firebase's Node SDK defaults to in-memory persistence, so the daemon
+// re-authenticates (browser popup) on every launch. This persistence
+// stores the auth state (including the refresh token Firebase uses to
+// silently mint new ID tokens) in a JSON file, so a relaunch restores
+// the session without a browser.
+//
+// Firebase consumes a persistence as a CLASS: it does `new P()` and
+// calls the prototype methods below, and reads the static `type`
+// ('LOCAL' = durable). We can't pass the file path through the
+// zero-arg constructor the SDK uses, so `makeFilePersistence(path)` is
+// a factory returning a class bound to that path. This lets the
+// desktop app give each account its own credentials file.
+//
+// Security: the file holds a refresh token, so it's written 0600.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Where to store an account's persisted auth. The desktop app passes
+// an explicit per-account path via the COMPOUND_AUTH_FILE env var
+// (each account gets its own file). The CLI falls back to a stable
+// per-(project, account) path under the user's config dir, keyed by
+// email (or orgId) so two accounts on the same project don't collide.
+export function resolveAuthFilePath({ authFileEnv, homeDir, projectId, accountKey }) {
+  if (authFileEnv) return authFileEnv;
+  const safeAccount = String(accountKey || 'default').replace(/[^a-zA-Z0-9._@-]/g, '_');
+  const safeProject = String(projectId || 'default').replace(/[^a-zA-Z0-9._-]/g, '_');
+  return path.join(homeDir, '.config', 'compound-sync', `${safeProject}__${safeAccount}.json`);
+}
+
+export function makeFilePersistence(filePath) {
+  function readStore() {
+    try {
+      return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    } catch {
+      // Missing or unreadable file: start from an empty store.
+      return {};
+    }
+  }
+
+  function writeStore(store) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(store), { mode: 0o600 });
+  }
+
+  return class FilePersistence {
+    // Read by the SDK both as a static and as an instance property in
+    // different code paths; set both. 'LOCAL' = survives restarts.
+    static type = 'LOCAL';
+    type = 'LOCAL';
+
+    async _isAvailable() {
+      return true;
+    }
+
+    async _set(key, value) {
+      const store = readStore();
+      store[key] = value;
+      writeStore(store);
+    }
+
+    async _get(key) {
+      const store = readStore();
+      return Object.prototype.hasOwnProperty.call(store, key) ? store[key] : null;
+    }
+
+    async _remove(key) {
+      const store = readStore();
+      delete store[key];
+      writeStore(store);
+    }
+
+    // Cross-tab change listeners are a browser concern; no-ops in Node.
+    _addListener(_key, _listener) {}
+    _removeListener(_key, _listener) {}
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/compound-sync",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Bidirectional sync between Compound and local markdown files",
   "type": "module",
   "bin": {
@@ -14,11 +14,12 @@
     "folder-chain.js",
     "storage-helpers.js",
     "team-registry.js",
+    "auth-persistence.js",
     "README.md"
   ],
   "scripts": {
     "sync": "node sync.js",
-    "test:unit": "node --test config.test.js paths.test.js storage-helpers.test.js folder-chain.test.js team-registry.test.js",
+    "test:unit": "node --test config.test.js paths.test.js storage-helpers.test.js folder-chain.test.js team-registry.test.js auth-persistence.test.js",
     "test:integration": "firebase emulators:exec --only firestore,storage 'node --test files.test.js'",
     "test": "npm run test:unit && npm run test:integration"
   },

package/storage-helpers.js

@@ -80,6 +80,16 @@ const EXT_TO_MIME = {
   webm: 'video/webm',
   mov: 'video/quicktime',
   zip: 'application/zip',
+  // Office Open XML (modern Office). The full type strings are
+  // mandatory: tools that dispatch by mime (Excel, third-party readers)
+  // ignore alternative spellings.
+  xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  // Legacy Office formats (pre-2007 binary containers).
+  xls: 'application/vnd.ms-excel',
+  doc: 'application/msword',
+  ppt: 'application/vnd.ms-powerpoint',
 };
 
 export function mimeTypeFromExt(ext) {

package/sync.js

@@ -17,7 +17,7 @@
  */
 
 import { initializeApp } from 'firebase/app';
-import { getAuth, signInWithEmailAndPassword, signInWithCredential, GoogleAuthProvider } from 'firebase/auth';
+import { getAuth, initializeAuth, signInWithEmailAndPassword, signInWithCredential, GoogleAuthProvider } from 'firebase/auth';
 import {
   getFirestore, collection, doc, getDocs, getDoc, setDoc, addDoc, updateDoc, deleteDoc,
   query, where, onSnapshot
@@ -47,6 +47,7 @@ import {
 // Max file size enforced before upload. Mirrored in storage.rules.
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 import { resolveConfigPath, loadConfig, saveConfig } from './config.js';
+import { makeFilePersistence, resolveAuthFilePath } from './auth-persistence.js';
 import {
   scopeFromLocalPath,
   teamFolderName,
@@ -527,29 +528,57 @@ if (config._app) {
   }
 
   app = initializeApp(fbConfig);
-  const auth = getAuth(app);
   db = getFirestore(app);
 
-  // Sign in via browser (browser handles reCAPTCHA App Check)
-  console.log('');
-  const authResult = await browserAuth(fbConfig);
+  // File-backed auth persistence. A previously-signed-in session is
+  // restored here with no browser. The desktop app sets
+  // COMPOUND_AUTH_FILE per account; the CLI derives a per-(project,
+  // account) path under ~/.config/compound-sync. initializeAuth must
+  // run before any getAuth(app) for this app.
+  const authFilePath = resolveAuthFilePath({
+    authFileEnv: process.env.COMPOUND_AUTH_FILE,
+    homeDir: os.homedir(),
+    projectId: config.projectId,
+    accountKey: config.email || config.orgId,
+  });
+  const auth = initializeAuth(app, { persistence: makeFilePersistence(authFilePath) });
+  await auth.authStateReady();
 
-  // Initialize App Check BEFORE signing in on the Node.js side
-  // Use the Firebase ID token from the browser to get an App Check token
   const appCheckUrl = appCheckEndpoints[config.projectId];
-  if (appCheckUrl && authResult.firebaseIdToken) {
-    await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
-  }
 
-  if (authResult.method === 'google') {
-    const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
-    const cred = await signInWithCredential(auth, credential);
-    userId = cred.user.uid;
-    console.log(`Signed in as ${cred.user.email}`);
+  if (auth.currentUser) {
+    // Silent re-auth: session restored from persisted credentials, no
+    // browser. App Check (custom provider) mints its token from a
+    // fresh ID token, which the refresh-token flow obtains without a
+    // browser.
+    userId = auth.currentUser.uid;
+    if (appCheckUrl) {
+      const idToken = await auth.currentUser.getIdToken();
+      await initAppCheckWithIdToken(app, appCheckUrl, idToken);
+    }
+    console.log(`Signed in (silent) as ${auth.currentUser.email || userId}`);
   } else {
-    const cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
-    userId = cred.user.uid;
-    console.log(`Signed in as ${cred.user.email}`);
+    // First run for this account: interactive browser sign-in. The
+    // result is persisted, so later launches take the silent path.
+    console.log('');
+    const authResult = await browserAuth(fbConfig);
+
+    // Initialize App Check BEFORE signing in on the Node.js side, using
+    // the Firebase ID token from the browser.
+    if (appCheckUrl && authResult.firebaseIdToken) {
+      await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+    }
+
+    if (authResult.method === 'google') {
+      const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
+      const cred = await signInWithCredential(auth, credential);
+      userId = cred.user.uid;
+      console.log(`Signed in as ${cred.user.email}`);
+    } else {
+      const cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
+      userId = cred.user.uid;
+      console.log(`Signed in as ${cred.user.email}`);
+    }
   }
 
 }