@hardfin/cli 0.0.2-dev.13 → 0.0.2-dev.14

package/README.md

@@ -285,9 +285,9 @@ Nothing secret is printed. An API key and a refresh token are each reported as a
 `sha256:` fingerprint, which identifies a credential across two machines without disclosing
 it.
 
-`refreshExpiresAt` is an estimate. Hardfin expires an unused refresh token after 90 days,
-but the token endpoint reports no expiry, so the CLI applies that rule to the date it last
-renewed. The flag `refreshExpiryIsEstimated` says so in the output.
+`refreshExpiresAt` is what the server said when it issued the token. A sign in stored before
+the server reported one falls back to Hardfin's 90-day rule, and `refreshExpiryIsEstimated`
+says which of the two you are looking at.
 
 ## Local configuration
 

package/dist/cli.js

@@ -293,6 +293,7 @@ const TokenResponse = z.looseObject({
 	token_type: z.string(),
 	expires_in: z.number().optional(),
 	refresh_token: z.string().optional(),
+	refresh_token_expires_in: z.number().optional(),
 	scope: z.string().optional()
 });
 /** GrantFailure is a token request the authorization server refused. */
@@ -351,6 +352,7 @@ async function toTokens(url, form) {
 	return {
 		accessToken: parsed.data.access_token,
 		refreshToken: parsed.data.refresh_token,
+		refreshExpiresAt: parsed.data.refresh_token_expires_in === void 0 ? void 0 : Date.now() + parsed.data.refresh_token_expires_in * 1e3,
 		scope: parsed.data.scope,
 		expiresAt: parsed.data.expires_in === void 0 ? void 0 : Date.now() + parsed.data.expires_in * 1e3
 	};
@@ -375,12 +377,13 @@ function toCredentialPath() {
 * family lifetime runs from. Callers hold the credential lock, which is what makes a write
 * from another process merge rather than disappear.
 */
-function keep(issuer, refreshToken) {
+function keep(issuer, refreshToken, expiresAt) {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const record = {
 		refreshToken,
 		signedInAt: toCredential(issuer)?.signedInAt ?? now,
-		renewedAt: now
+		renewedAt: now,
+		expiresAt: expiresAt === void 0 ? void 0 : new Date(expiresAt).toISOString()
 	};
 	const keyring = toKeyring(issuer);
 	if (keyring) try {
@@ -566,7 +569,7 @@ async function toAccessToken(settings, refreshToken) {
 		try {
 			const tokens = await toTokensFromRefresh(metadata.token_endpoint, settings.clientId, latest);
 			held.set(settings.issuerUrl, tokens);
-			if (tokens.refreshToken && tokens.refreshToken !== latest) keep(settings.issuerUrl, tokens.refreshToken);
+			if (tokens.refreshToken && tokens.refreshToken !== latest) keep(settings.issuerUrl, tokens.refreshToken, tokens.refreshExpiresAt);
 			return tokens;
 		} catch (error) {
 			if (error instanceof GrantFailure && isDead(error.code)) {
@@ -1366,7 +1369,7 @@ async function toSignedIn(input, metadata, tokens) {
 		writeFailure("the authorization server issued no refresh token, so this sign in cannot be kept", input.isJSON);
 		return ExitCode.ERROR;
 	}
-	const backend = await withLock(() => keep(input.resolved.settings.issuerUrl, refreshToken));
+	const backend = await withLock(() => keep(input.resolved.settings.issuerUrl, refreshToken, tokens.refreshExpiresAt));
 	if (input.isJSON) {
 		writeData({
 			signedIn: true,
@@ -4378,6 +4381,23 @@ const surfaceCommands = [
 			}
 		]
 	},
+	{
+		name: "token",
+		summary: "Token commands",
+		arguments: [],
+		flags: [],
+		examples: [],
+		subcommands: [defineOperation({
+			name: "get",
+			summary: "Report the credential this CLI is calling with",
+			example: "hardfin token get",
+			method: "GET",
+			path: "/token",
+			pathParameters: [],
+			queryFlags: [],
+			bodyFlags: []
+		})]
+	},
 	{
 		name: "url-link",
 		summary: "URL link commands",
@@ -4514,8 +4534,8 @@ function toFile(path) {
 //#endregion
 //#region src/command/status.ts
 /**
-* Hardfin expires an unused refresh token after this long. It is the server's rule, not the
-* CLI's, and the token endpoint reports no expiry, so what this produces is an estimate.
+* What the CLI falls back to for an older sign in, stored before the server began reporting
+* when a refresh token expires. Hardfin's own rule, and an estimate rather than a fact.
 */
 const REFRESH_SLIDING_DAYS = 90;
 const statusCommand = defineCommand({
@@ -4619,8 +4639,8 @@ function toCredentialReport(apiKey, stored) {
 		fingerprint: toFingerprint(stored.refreshToken),
 		signedInAt: stored.signedInAt ?? null,
 		renewedAt: stored.renewedAt ?? null,
-		refreshExpiresAt: toRefreshExpiry(stored.renewedAt),
-		refreshExpiryIsEstimated: true
+		refreshExpiresAt: stored.expiresAt ?? toRefreshExpiry(stored.renewedAt),
+		refreshExpiryIsEstimated: stored.expiresAt === void 0
 	};
 }
 function toServerReport(metadata) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hardfin/cli",
-    "version": "0.0.2-dev.13",
+    "version": "0.0.2-dev.14",
     "description": "Command line interface for the Hardfin API",
     "license": "Apache-2.0",
     "author": "Hardfin, Inc.",