@gatemux/dsh-gatemux-login 1.0.0 → 1.0.2

package/README.md

@@ -64,7 +64,9 @@ Model requests are billed to your own GateMux balance.
 ```
 
 Sign in from the app's account settings. Authorization opens in your browser and
-returns to the app.
+returns to the app. The tab itself is left on a confirmation page — GateMux
+serves no hosted completion page, so there is nothing else to show there — and it
+never auto-closes; you can close it once the app is signed in.
 
 ## Models
 

package/account.js

@@ -68,6 +68,16 @@ function parseGrant(payload, issuer) {
   return { version: 1, accessToken, refreshToken, expiresAt, issuer }
 }
 
+/**
+ * Read a stored record as a grant this deployment may use.
+ * @param record - record at this provider's key, or undefined when none is stored.
+ * @param issuer - origin a grant must carry to be usable here.
+ * @returns the parsed grant, or null when no record is stored or it is unusable.
+ */
+function usableGrant(record, issuer) {
+  return record !== undefined && record.kind === 'grant' ? parseGrant(record.payload, issuer) : null
+}
+
 /** Accept a bare HTTPS origin, rejecting paths, credentials, and non-HTTPS schemes. */
 function originOf(value) {
   let url
@@ -182,22 +192,27 @@ export class GateMuxAccount extends DeepSeekAccount {
   /** Discard a stored grant issued by another environment. */
   async [Service.init]() {
     const record = await this.ctx.credentials.readRecord(KEY)
-    if (record === undefined) return
-    const grant = record.kind === 'grant' ? parseGrant(record.payload, this.issuer) : null
-    if (grant !== null) return
+    if (record === undefined || usableGrant(record, this.issuer) !== null) return
     await this.ctx.credentials.deleteRecord(KEY)
     this.logger.warn('stored grant discarded', { reason: 'unreadable-or-foreign-issuer' })
   }
 
   async getState() {
     const record = await this.ctx.credentials.readRecord(KEY)
-    if (record !== undefined && (record.kind !== 'grant' || parseGrant(record.payload, this.issuer) === null)) {
-      throw new GateMuxAuthError('stored grant is unreadable', 'storage')
+    const grant = usableGrant(record, this.issuer)
+    // A record this deployment cannot use reads as absent instead of raising: every
+    // caller turns a throw into a failure with no diagnosis. `startSignIn` returns
+    // this outside its own catch, so a raise there rejects the start call and the
+    // dialog reports a sign-in failure for a record the person never supplied, and
+    // `watch` ends the account stream. The record is left in place for a sign-in to
+    // overwrite; discarding it here could delete a grant committed since the read.
+    if (record !== undefined && grant === null) {
+      this.logger.warn('stored grant is unreadable', { reason: 'unreadable-or-foreign-issuer' })
     }
     const attempt = this.attempt?.view ?? null
     return {
-      status: record === undefined ? 'signed-out' : 'credential-stored',
-      attempt: record === undefined && attempt?.phase === 'succeeded' ? null : attempt,
+      status: grant === null ? 'signed-out' : 'credential-stored',
+      attempt: grant === null && attempt?.phase === 'succeeded' ? null : attempt,
       links: {
         usageUrl: `${this.consoleOrigin}/app/usage`,
         topUpUrl: `${this.consoleOrigin}/app/billing`,
@@ -277,6 +292,12 @@ export class GateMuxAccount extends DeepSeekAccount {
       this.update(attempt, { phase: outcome.status === 'authorized' ? 'succeeded' : 'cancelled' })
       if (outcome.status === 'authorized' && attempt.completionUrl !== undefined) {
         attempt.callback?.writeHead(302, { location: attempt.completionUrl, 'cache-control': 'no-store' }).end()
+      } else if (outcome.status === 'authorized') {
+        // GateMux serves no hosted completion page, so this tab is the only place
+        // the result is visible; answering 204 would leave it blank.
+        this.writeCallbackPage(attempt, 'Signed in', attempt.loginSource === 'web'
+          ? 'Signed in to GateMux. Close this tab and continue in the original tab.'
+          : 'Signed in to GateMux. Close this tab and continue in DeepSeek Harness.')
       } else {
         attempt.callback?.writeHead(204, { 'cache-control': 'no-store' }).end()
       }
@@ -650,21 +671,30 @@ export class GateMuxAccount extends DeepSeekAccount {
   }
 
 
+  /**
+   * Answer the browser tab the flow was authorized in with a short page. The
+   * application opens that tab outside itself and never reads this response, so
+   * the page exists only for the person looking at it; text is static, which is
+   * why no script is needed and the policy can forbid every source.
+   * @param attempt - in-flight attempt whose callback is being answered.
+   * @param title - page title and heading.
+   * @param message - what the person should do next.
+   */
+  writeCallbackPage(attempt, title, message) {
+    attempt.callback?.writeHead(200, {
+      'content-type': 'text/html; charset=utf-8',
+      'cache-control': 'no-store',
+      'content-security-policy': `default-src 'none'; frame-ancestors 'none'`,
+      'referrer-policy': 'no-referrer',
+    }).end(`<!doctype html><html lang="en"><meta charset="utf-8"><title>${title}</title>`
+      + `<body><p>${message}</p></body></html>`)
+  }
+
   /** Return the browser to the application after a failed exchange. */
   finishFailedCallback(attempt) {
-    if (attempt.loginSource === 'web') {
-      const nonce = randomBytes(16).toString('base64url')
-      const message = 'Sign-in failed. Close this tab and try again in the original tab.'
-      attempt.callback?.writeHead(200, {
-        'content-type': 'text/html; charset=utf-8',
-        'cache-control': 'no-store',
-        'content-security-policy': `default-src 'none'; frame-ancestors 'none'`,
-        'referrer-policy': 'no-referrer',
-      }).end(`<!doctype html><html lang="en"><meta charset="utf-8"><title>${message}</title>`
-        + `<body><p>${message}</p></body></html>`)
-    } else {
-      attempt.callback?.writeHead(204, { 'cache-control': 'no-store' }).end()
-    }
+    this.writeCallbackPage(attempt, 'Sign-in failed', attempt.loginSource === 'web'
+      ? 'Sign-in failed. Close this tab and try again in the original tab.'
+      : 'Sign-in failed. Close this tab and try again in DeepSeek Harness.')
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatemux/dsh-gatemux-login",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "description": "Sign in with GateMux for DeepSeek Harness: users pay from their own GateMux balance.",
   "publishConfig": {