@lanonasis/cli 3.9.5 → 3.9.7

package/dist/utils/config.js

@@ -190,6 +190,10 @@ export class CLIConfig {
     }
     // Enhanced Service Discovery Integration
     async discoverServices(verbose = false) {
+        // Honour manually configured endpoints — skip auto-discovery so we don't clobber them.
+        if (this.config.manualEndpointOverrides) {
+            return;
+        }
         const isTestEnvironment = process.env.NODE_ENV === 'test';
         const forceDiscovery = process.env.FORCE_SERVICE_DISCOVERY === 'true';
         if ((isTestEnvironment && !forceDiscovery) || process.env.SKIP_SERVICE_DISCOVERY === 'true') {
@@ -434,6 +438,210 @@ export class CLIConfig {
         }
         throw new Error('Auth health endpoints unreachable');
     }
+    getAuthVerificationEndpoints(pathname) {
+        const authBase = (this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com').replace(/\/$/, '');
+        return Array.from(new Set([
+            `${authBase}${pathname}`,
+            `https://auth.lanonasis.com${pathname}`,
+            `http://localhost:4000${pathname}`
+        ]));
+    }
+    extractAuthErrorMessage(payload) {
+        if (!payload || typeof payload !== 'object') {
+            return undefined;
+        }
+        const data = payload;
+        const fields = ['message', 'error', 'reason', 'code'];
+        for (const field of fields) {
+            const value = data[field];
+            if (typeof value === 'string' && value.trim().length > 0) {
+                return value;
+            }
+        }
+        return undefined;
+    }
+    async verifyTokenWithAuthGateway(token) {
+        const headers = {
+            'Authorization': `Bearer ${token}`,
+            'X-Project-Scope': 'lanonasis-maas'
+        };
+        let fallbackReason = 'Unable to verify token with auth gateway';
+        // Primary check (required by auth contract): /v1/auth/verify
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true || Boolean(payload.payload)) {
+                    return { valid: true, method: 'token', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'token',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'Token is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                const responseCode = typeof responsePayload?.code === 'string' ? responsePayload.code : undefined;
+                const reason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+                fallbackReason = reason;
+                // If auth gateway explicitly rejected token, stop early.
+                if ((normalizedError.response?.status === 401 || normalizedError.response?.status === 403) &&
+                    responseCode &&
+                    responseCode !== 'AUTH_TOKEN_MISSING') {
+                    return { valid: false, method: 'token', endpoint, reason };
+                }
+            }
+        }
+        // Fallback for deployments where proxy layers strip Authorization headers.
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify-token')) {
+            try {
+                const response = await axios.post(endpoint, { token }, {
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-Project-Scope': 'lanonasis-maas'
+                    },
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true) {
+                    return { valid: true, method: 'token', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'token',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'Token is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                fallbackReason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+            }
+        }
+        return {
+            valid: false,
+            method: 'token',
+            reason: fallbackReason
+        };
+    }
+    async verifyVendorKeyWithAuthGateway(vendorKey) {
+        // Detect whether the stored "vendor key" is actually an OAuth/JWT access token
+        // (3-part base64url string separated by dots). OAuth tokens must be verified via the
+        // Bearer token path (/v1/auth/verify-token), not as API keys (/v1/auth/verify-api-key),
+        // because they are not stored in the api_keys table.
+        const isJwtFormat = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(vendorKey.trim());
+        if (isJwtFormat) {
+            // Delegate to token verification — the auth gateway's UAI router accepts Bearer tokens
+            // on /v1/auth/verify (requireAuth) and /v1/auth/verify-token (public, body-based).
+            return this.verifyTokenWithAuthGateway(vendorKey);
+        }
+        const headers = {
+            'X-API-Key': vendorKey,
+            'X-Auth-Method': 'vendor_key',
+            'X-Project-Scope': 'lanonasis-maas'
+        };
+        let fallbackReason = 'Unable to verify API key with auth gateway';
+        // Primary check (required by auth contract): /v1/auth/verify
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true || Boolean(payload.payload)) {
+                    return { valid: true, method: 'vendor_key', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'vendor_key',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'API key is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                const responseCode = typeof responsePayload?.code === 'string' ? responsePayload.code : undefined;
+                const reason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+                fallbackReason = reason;
+                // If auth gateway explicitly rejected API key, stop early.
+                if ((normalizedError.response?.status === 401 || normalizedError.response?.status === 403) &&
+                    responseCode &&
+                    responseCode !== 'AUTH_TOKEN_MISSING') {
+                    return { valid: false, method: 'vendor_key', endpoint, reason };
+                }
+            }
+        }
+        // Fallback for deployments where reverse proxies don't forward custom auth headers on /verify.
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify-api-key')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true) {
+                    return { valid: true, method: 'vendor_key', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'vendor_key',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'API key is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                fallbackReason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+            }
+        }
+        return {
+            valid: false,
+            method: 'vendor_key',
+            reason: fallbackReason
+        };
+    }
+    async verifyCurrentCredentialsWithServer() {
+        await this.refreshTokenIfNeeded();
+        await this.discoverServices();
+        const token = this.getToken();
+        const vendorKey = await this.getVendorKeyAsync();
+        if (this.config.authMethod === 'vendor_key' && vendorKey) {
+            return this.verifyVendorKeyWithAuthGateway(vendorKey);
+        }
+        if (token) {
+            return this.verifyTokenWithAuthGateway(token);
+        }
+        if (vendorKey) {
+            return this.verifyVendorKeyWithAuthGateway(vendorKey);
+        }
+        return {
+            valid: false,
+            method: 'none',
+            reason: 'No credentials configured'
+        };
+    }
     // Manual endpoint override functionality
     async setManualEndpoints(endpoints) {
         if (!this.config.discoveredServices) {
@@ -461,6 +669,17 @@ export class CLIConfig {
     hasManualEndpointOverrides() {
         return !!this.config.manualEndpointOverrides;
     }
+    /**
+     * Clears the in-memory auth cache and removes the `lastValidated` timestamp.
+     * Called after a definitive 401 from the memory API so that the next
+     * `isAuthenticated()` call performs a fresh server verification rather than
+     * returning a stale cached result.
+     */
+    async invalidateAuthCache() {
+        this.authCheckCache = null;
+        delete this.config.lastValidated;
+        await this.save().catch(() => { });
+    }
     async clearManualEndpointOverrides() {
         delete this.config.manualEndpointOverrides;
         delete this.config.lastManualEndpointUpdate;
@@ -473,15 +692,20 @@ export class CLIConfig {
             'https://auth.lanonasis.com';
     }
     // Enhanced authentication support
-    async setVendorKey(vendorKey) {
+    async setVendorKey(vendorKey, options = {}) {
         const trimmedKey = typeof vendorKey === 'string' ? vendorKey.trim() : '';
         // Minimal format validation (non-empty); rely on server-side checks for everything else
         const formatValidation = this.validateVendorKeyFormat(trimmedKey);
         if (formatValidation !== true) {
             throw new Error(typeof formatValidation === 'string' ? formatValidation : 'Vendor key is invalid');
         }
-        // Server-side validation
-        await this.validateVendorKeyWithServer(trimmedKey);
+        // Skip server-side validation when the caller already holds a valid auth credential
+        // (e.g. an OAuth access token being stored for MCP/API access — auth-gateway won't
+        // recognise it as a vendor key even though the memory API accepts it).
+        const isOAuthContext = ['oauth', 'oauth2'].includes(this.config.authMethod || '');
+        if (!options.skipServerValidation && !isOAuthContext) {
+            await this.validateVendorKeyWithServer(trimmedKey);
+        }
         // Initialize and store using ApiKeyStorage from @lanonasis/oauth-client
         // This handles encryption automatically (AES-256-GCM with machine-derived key)
         await this.apiKeyStorage.initialize();
@@ -520,16 +744,12 @@ export class CLIConfig {
             return;
         }
         try {
-            // Import axios dynamically to avoid circular dependency
-            // Ensure service discovery is done
             await this.discoverServices();
-            const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            // Use pingAuthHealth for validation (simpler and more reliable)
-            await this.pingAuthHealth(axios, authBase, {
-                'X-API-Key': vendorKey,
-                'X-Auth-Method': 'vendor_key',
-                'X-Project-Scope': 'lanonasis-maas'
-            }, { timeout: 10000, proxy: false });
+            const verification = await this.verifyVendorKeyWithAuthGateway(vendorKey);
+            if (verification.valid) {
+                return;
+            }
+            throw new Error(verification.reason || 'Authentication failed. The key may be invalid, expired, or revoked.');
         }
         catch (error) {
             const normalizedError = this.normalizeServiceError(error);
@@ -687,36 +907,40 @@ export class CLIConfig {
             const vendorKey = await this.getVendorKeyAsync();
             if (!vendorKey)
                 return false;
-            // Check cache first
+            // Check in-memory cache first (5-minute TTL)
             if (this.authCheckCache && (Date.now() - this.authCheckCache.timestamp) < this.AUTH_CACHE_TTL) {
                 return this.authCheckCache.isValid;
             }
-            // Check if recently validated (within 24 hours)
+            // Track lastValidated for the offline grace period used in the catch block.
+            // The 24-hour skip-server-validation gate has been removed: it allowed expired/revoked
+            // keys to appear valid as long as they had been validated within the past day.
             const lastValidated = this.config.lastValidated;
-            const recentlyValidated = lastValidated &&
-                (Date.now() - new Date(lastValidated).getTime()) < (24 * 60 * 60 * 1000);
-            if (recentlyValidated) {
-                this.authCheckCache = { isValid: true, timestamp: Date.now() };
-                return true;
-            }
-            // Vendor key not recently validated - verify with server
+            // Verify with server on every cache-miss
             try {
-                await this.discoverServices();
-                const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-                // Ping auth health with vendor key to verify it's still valid
-                await this.pingAuthHealth(axios, authBase, {
-                    'X-API-Key': vendorKey,
-                    'X-Auth-Method': 'vendor_key',
-                    'X-Project-Scope': 'lanonasis-maas'
-                }, { timeout: 5000, proxy: false });
+                const verification = await this.verifyVendorKeyWithAuthGateway(vendorKey);
+                if (!verification.valid) {
+                    // Auth gateway explicitly rejected the key — no grace period applies.
+                    this.authCheckCache = { isValid: false, timestamp: Date.now() };
+                    return false;
+                }
                 // Update last validated timestamp on success
                 this.config.lastValidated = new Date().toISOString();
                 await this.save().catch(() => { }); // Don't fail auth check if save fails
                 this.authCheckCache = { isValid: true, timestamp: Date.now() };
                 return true;
             }
-            catch (error) {
-                // Server validation failed - check for grace period (7 days offline)
+            catch (err) {
+                // verifyVendorKeyWithAuthGateway throws only on network/timeout errors
+                // (explicit 401/403 returns {valid:false} without throwing).
+                // Apply the 7-day offline grace ONLY for genuine network failures.
+                const normalizedErr = this.normalizeServiceError(err);
+                const httpStatus = normalizedErr.response?.status ?? 0;
+                if (httpStatus === 401 || httpStatus === 403) {
+                    // Explicit auth rejection propagated as an exception — definitely invalid.
+                    this.authCheckCache = { isValid: false, timestamp: Date.now() };
+                    return false;
+                }
+                // Network / server error — apply offline grace period
                 const gracePeriod = 7 * 24 * 60 * 60 * 1000;
                 const withinGracePeriod = lastValidated &&
                     (Date.now() - new Date(lastValidated).getTime()) < gracePeriod;
@@ -727,7 +951,6 @@ export class CLIConfig {
                     this.authCheckCache = { isValid: true, timestamp: Date.now() };
                     return true;
                 }
-                // Grace period expired - require server validation
                 if (process.env.CLI_VERBOSE === 'true') {
                     console.warn('⚠️  Vendor key validation failed and grace period expired');
                 }
@@ -947,22 +1170,14 @@ export class CLIConfig {
             if (!vendorKey && !token) {
                 return false;
             }
-            // Import axios dynamically to avoid circular dependency
-            // Ensure service discovery is done
-            await this.discoverServices();
-            const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            const headers = {
-                'X-Project-Scope': 'lanonasis-maas'
-            };
-            if (vendorKey) {
-                headers['X-API-Key'] = vendorKey;
-                headers['X-Auth-Method'] = 'vendor_key';
-            }
-            else if (token) {
-                headers['Authorization'] = `Bearer ${token}`;
-                headers['X-Auth-Method'] = 'jwt';
+            const verification = this.config.authMethod === 'vendor_key' && vendorKey
+                ? await this.verifyVendorKeyWithAuthGateway(vendorKey)
+                : token
+                    ? await this.verifyTokenWithAuthGateway(token)
+                    : await this.verifyVendorKeyWithAuthGateway(vendorKey);
+            if (!verification.valid) {
+                throw new Error(verification.reason || 'Stored credentials are invalid');
             }
-            await this.pingAuthHealth(axios, authBase, headers);
             // Update last validated timestamp
             this.config.lastValidated = new Date().toISOString();
             await this.resetFailureCount();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.5",
+  "version": "3.9.7",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -52,37 +52,37 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@lanonasis/oauth-client": "1.2.5",
+    "@lanonasis/oauth-client": "2.0.0",
     "@lanonasis/security-sdk": "1.0.5",
-    "@modelcontextprotocol/sdk": "^1.25.2",
-    "axios": "^1.7.7",
-    "chalk": "^5.3.0",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "axios": "^1.13.5",
+    "chalk": "^5.6.2",
     "cli-progress": "^3.12.0",
-    "cli-table3": "^0.6.3",
-    "commander": "^12.1.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^14.0.3",
     "date-fns": "^4.1.0",
-    "dotenv": "^16.4.5",
-    "eventsource": "^4.0.0",
-    "inquirer": "^9.3.6",
+    "dotenv": "^17.3.1",
+    "eventsource": "^4.1.0",
+    "inquirer": "^13.2.5",
     "jwt-decode": "^4.0.0",
-    "open": "^10.2.0",
-    "ora": "^8.0.1",
+    "open": "^11.0.0",
+    "ora": "^9.3.0",
     "table": "^6.9.0",
     "word-wrap": "^1.2.5",
-    "ws": "^8.18.0",
-    "zod": "^3.24.4"
+    "ws": "^8.19.0",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@jest/globals": "^29.7.0",
+    "@jest/globals": "^30.2.0",
     "@types/cli-progress": "^3.11.6",
-    "@types/inquirer": "^9.0.7",
-    "@types/node": "^22.19.3",
-    "@types/ws": "^8.5.12",
-    "fast-check": "^3.15.1",
-    "jest": "^29.7.0",
-    "rimraf": "^5.0.7",
-    "ts-jest": "^29.1.1",
-    "typescript": "^5.7.2"
+    "@types/inquirer": "^9.0.9",
+    "@types/node": "^25.3.0",
+    "@types/ws": "^8.18.1",
+    "fast-check": "^4.5.3",
+    "jest": "^30.2.0",
+    "rimraf": "^6.1.3",
+    "ts-jest": "^29.4.6",
+    "typescript": "^5.9.3"
   },
   "scripts": {
     "build": "rimraf dist && tsc -p tsconfig.json",