@dropsh/plugin-oauth2 0.7.3 → 0.7.5

package/dist/plugins/oauth2/src/provider.js

@@ -172,12 +172,36 @@ export function oauth2Provider(cfg) {
                 current = minted;
                 await rt.save(minted);
             }
+            // The session slot is shared by every process of this user (conductor, ui,
+            // agent CLI calls), and the server rotates the refresh token on each use.
+            // Adopt what another process stored instead of refreshing with a revoked token;
+            // returns true when the adopted access token is still valid.
+            async function adoptStored() {
+                const stored = await rt.load?.();
+                if (!stored ||
+                    stored.access_token === current.access_token ||
+                    typeof stored.refresh_token !== "string")
+                    return false;
+                current = stored;
+                const expiresAt = typeof stored.expires_at === "number" ? stored.expires_at : 0;
+                return expiresAt - 30_000 > rt.now();
+            }
             async function renewSession() {
                 if (cfg.type === "oauth2_authcode" || cfg.type === "oauth2_device_code") {
+                    if (await adoptStored())
+                        return;
                     const refresh = current.refresh_token;
                     if (typeof refresh !== "string")
                         throw new AuthError("Session expired. Run 'dropsh auth login'.");
-                    await refreshAuthcode(refresh);
+                    try {
+                        await refreshAuthcode(refresh);
+                    }
+                    catch (err) {
+                        // Lost the race: another process rotated the token between load and post.
+                        if (await adoptStored())
+                            return;
+                        throw err;
+                    }
                     return;
                 }
                 if (cfg.type === "oauth2_client_credentials") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dropsh/plugin-oauth2",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "type": "module",
   "main": "./dist/plugins/oauth2/src/index.js",
   "types": "./dist/plugins/oauth2/src/index.d.ts",
@@ -23,7 +23,7 @@
   "devDependencies": {
     "typescript": "^5.6.0",
     "vitest": "^4.1.8",
-    "dropsh": "0.7.3"
+    "dropsh": "0.7.5"
   },
   "scripts": {
     "build": "tsc",