@doubling/compound-sync 1.7.0 → 1.9.5

package/pre-mint-app-check.js

@@ -0,0 +1,84 @@
+// Pre-mint an App Check token BEFORE the Firebase Auth SDK validates
+// the cached refresh token at startup. Background:
+//
+// The Firebase JS SDK, on `initializeAuth(...)` with a persisted user,
+// calls identitytoolkit.googleapis.com/:lookup as part of authStateReady
+// to validate the user. With App Check enforcement on Authentication
+// enabled in Firebase, that :lookup call requires an App Check header.
+// Our daemon initializes App Check (CustomProvider) only AFTER
+// authStateReady, because the CustomProvider's mint flow needs an ID
+// token from auth.currentUser. Result: :lookup fails, SDK marks the
+// user invalid, calls persistence._remove(userKey), and the user is
+// prompted for a browser sign-in on every relaunch.
+//
+// Fix: before authStateReady, read the persisted refresh token directly
+// from the auth.json file, exchange it for a fresh ID token via
+// securetoken.googleapis.com (which is NOT under App Check enforcement;
+// it is Google's OAuth secure-token service), use that ID token to mint
+// an App Check token from our mintappchecktoken cloud function, and
+// initializeAppCheck. Now the SDK's :lookup carries the App Check
+// header and silent restore succeeds.
+
+import fs from 'node:fs';
+
+// Read the refresh token stored by Firebase Auth's file persistence.
+// The persistence stores a single key per app:
+//   'firebase:authUser:<apiKey>:[DEFAULT]'  →  { uid, ..., stsTokenManager: { refreshToken, ... } }
+// We don't care which apiKey is in the key (we don't have it handy at
+// this layer): we walk the keys, pick the first 'firebase:authUser:'
+// entry, and pull its refresh token. Returns null when there's nothing
+// usable (file missing, corrupt, empty, or no refresh token field).
+export function readPersistedRefreshToken(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return null;
+  }
+  let store;
+  try {
+    store = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!store || typeof store !== 'object') return null;
+  for (const key of Object.keys(store)) {
+    if (!key.startsWith('firebase:authUser:')) continue;
+    const user = store[key];
+    const rt = user?.stsTokenManager?.refreshToken;
+    if (typeof rt === 'string' && rt.length > 0) return rt;
+  }
+  return null;
+}
+
+// Exchange a Firebase refresh token for a fresh ID token via Google's
+// secure token endpoint. This endpoint lives at securetoken.googleapis.com
+// and is intentionally NOT under App Check enforcement (App Check
+// enforcement on Auth covers identitytoolkit.googleapis.com only), so
+// this call works even with no App Check token in flight, breaking the
+// chicken-and-egg at daemon startup.
+//
+// Returns the new ID token string. Throws on non-OK responses: a
+// revoked or expired refresh token will return 400 here, and the
+// caller falls back to the browser sign-in path.
+//
+// `deps.fetch` is injectable for tests; defaults to the global fetch.
+export async function exchangeRefreshTokenForIdToken(refreshToken, apiKey, deps = {}) {
+  const f = deps.fetch || fetch;
+  const url = `https://securetoken.googleapis.com/v1/token?key=${apiKey}`;
+  const body = new URLSearchParams({
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+  }).toString();
+  const resp = await f(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+  if (!resp.ok) {
+    const errBody = await resp.text().catch(() => '');
+    throw new Error(`secure-token exchange failed (${resp.status}): ${errBody}`);
+  }
+  const json = await resp.json();
+  return json.id_token;
+}

package/setup-auth-with-pre-mint.js

@@ -0,0 +1,84 @@
+// Orchestrates the daemon's auth startup with App Check enforcement on
+// Authentication in mind. The contract this file enforces is the
+// ordering: initializeAppCheck must happen BEFORE initializeAuth.
+//
+// Why ordering matters (the bug we fixed):
+//
+// initializeAuth(app, { persistence }) returns synchronously, but it
+// schedules the cached-user validation (an identitytoolkit :lookup
+// request) as a microtask chain that fires almost immediately. If
+// App Check is initialized AFTER initializeAuth, that :lookup goes
+// out without an X-Firebase-AppCheck header. Under Auth App Check
+// enforcement the backend rejects, the SDK marks the cached user
+// invalid, sets currentUser to null, and authStateReady resolves with
+// no user. The daemon then falls through to the browser-auth path on
+// every relaunch, even though we just spent ~500ms pre-minting an
+// App Check token.
+//
+// Calling initializeAppCheck first registers the App Check provider on
+// the app BEFORE the Auth SDK is constructed. When Auth then issues
+// its :lookup, it picks up the provider and the header is on the
+// request. Silent restore works.
+//
+// All Firebase SDK functions and the project's own helpers are passed
+// in as deps so the call order can be unit-tested without standing up
+// real network calls. sync.js wires the real deps in two places (the
+// discover path and the main daemon path), eliminating the duplicated
+// inline pre-mint blocks that previously lived in sync.js.
+
+export async function setupAuthWithPreMint(
+  { app, authFilePath, apiKey, appCheckUrl },
+  deps,
+) {
+  const {
+    readPersistedRefreshToken,
+    exchangeRefreshTokenForIdToken,
+    initAppCheckWithIdToken,
+    makeFilePersistence,
+    initializeAuth,
+  } = deps;
+
+  // 1. Read the persisted refresh token directly, before involving the
+  //    Firebase Auth SDK. If there's nothing persisted (first launch),
+  //    this returns null and we skip pre-mint; the caller's
+  //    browser-auth path handles first-run sign-in.
+  const refreshToken = readPersistedRefreshToken(authFilePath);
+
+  // 2. Pre-mint App Check on the app, if we have what we need. This
+  //    MUST complete before step 3 (initializeAuth), or the SDK's
+  //    startup :lookup races our pre-mint and goes out unauthed.
+  let appCheckPreMinted = false;
+  if (refreshToken && appCheckUrl) {
+    try {
+      const idToken = await exchangeRefreshTokenForIdToken(refreshToken, apiKey);
+      await initAppCheckWithIdToken(app, appCheckUrl, idToken);
+      appCheckPreMinted = true;
+    } catch (err) {
+      // Refresh token revoked, network blip, or App Check function
+      // error: don't block startup. The Auth SDK's :lookup will still
+      // fail under enforcement (and the SDK will null-out currentUser),
+      // and the caller's browser-auth path will take over. The
+      // persistence freeze guard keeps the on-disk file intact.
+      console.log(`Pre-mint App Check failed (falling back to browser): ${err.message}`);
+    }
+  }
+
+  // 3. Now initializeAuth. App Check (if it was pre-minted) is already
+  //    registered on the app, so the SDK's :lookup carries the header.
+  //    makeFilePersistence returns a CLASS (Firebase's persistence
+  //    contract is `new Persistence()`), and the unfreeze method is a
+  //    static on that class — we call it as PersistenceClass.unfreeze().
+  const PersistenceClass = makeFilePersistence(authFilePath);
+  const auth = initializeAuth(app, { persistence: PersistenceClass });
+
+  // 4. Wait for the SDK to finish its startup validation. If we
+  //    pre-minted successfully and the refresh token is still valid,
+  //    auth.currentUser will be the restored user.
+  await auth.authStateReady();
+
+  // 5. Unfreeze persistence so post-init _remove calls (e.g., an
+  //    explicit sign-out by the user) actually clear the file.
+  PersistenceClass.unfreeze();
+
+  return { auth, persistence: PersistenceClass, appCheckPreMinted };
+}

package/sync-state.js

@@ -0,0 +1,32 @@
+// Persisted sync-state store (DOU-154).
+//
+// Records, per file (keyed by `scope:docPath`), the content hash as of
+// the last successful sync. The daemon loads this on start so it can
+// decide pull/push direction by content even across restarts (the
+// in-memory baseline alone is empty on a cold start, which forced an
+// unreliable mtime fallback). Small JSON file; best-effort writes (a
+// failed write must never take down sync).
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Load the baseline map ({ trackingKey: contentHash }). Missing or
+// corrupt file reads as {} so a first run / damaged state can't crash.
+export function loadSyncState(filePath) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+export function saveSyncState(filePath, state) {
+  try {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(state));
+  } catch {
+    // Best-effort: losing the baseline only costs us a cold-start
+    // reconciliation next launch, never data.
+  }
+}