@levr-one/auth 1.0.0

package/dist/oauth-client.test.js

@@ -0,0 +1,290 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+// Mock token-store so OAuthClient constructor doesn't hit disk
+vi.mock('./token-store.js', () => ({
+    loadTokens: () => null,
+    saveTokens: vi.fn(),
+    clearTokens: vi.fn(),
+    restoreTokensFromBackup: () => false,
+    getTqDir: () => '/tmp/.tq',
+}));
+// Mock workspace-store so setTokens() can exercise saveWorkspace() without disk
+vi.mock('./workspace-store.js', () => ({
+    saveWorkspace: vi.fn(),
+    loadWorkspace: () => null,
+    clearWorkspace: vi.fn(),
+    getWorkspaceFilePath: () => '/tmp/.tq/workspace.json',
+}));
+// Mock config so loadConfig() returns a deterministic value
+vi.mock('./config.js', () => ({
+    loadConfig: () => ({
+        environment: 'staging',
+        apiUrl: 'https://api.test.com',
+        authUrl: 'https://api.test.com',
+        clientUrl: 'https://app.test.com',
+        oauthClientId: '2',
+    }),
+}));
+import { OAuthClient } from './oauth-client.js';
+import { saveTokens } from './token-store.js';
+import { saveWorkspace } from './workspace-store.js';
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+const deviceResponse = {
+    device_code: 'dev-code-123',
+    user_code: 'ABCD-1234',
+    verification_uri: 'https://api.test.com/v1/oauth/device',
+    verification_uri_complete: 'https://api.test.com/v1/oauth/device?user_code=ABCD-1234',
+    expires_in: 300,
+    interval: 1,
+};
+const tokenResponse = {
+    access_token: 'access-123',
+    token_type: 'bearer',
+    expires_in: 86400,
+    refresh_token: 'refresh-456',
+    scope: 'read:own write:own',
+};
+describe('OAuthClient.authorizeDevice', () => {
+    let client;
+    beforeEach(() => {
+        vi.useFakeTimers();
+        client = new OAuthClient({
+            clientId: '2',
+            authServerUrl: 'https://api.test.com',
+        });
+    });
+    afterEach(() => {
+        mockFetch.mockReset();
+        vi.useRealTimers();
+    });
+    /**
+     * Helper: start authorizeDevice(), advance fake timers until it resolves.
+     * Each tick advances past the polling interval so setTimeout unblocks.
+     */
+    async function drainPolling(promise) {
+        // Advance in small increments, yielding to microtasks between each,
+        // so fetch mocks resolve and the while-loop progresses.
+        for (let i = 0; i < 20; i++) {
+            await vi.advanceTimersByTimeAsync(6_000);
+        }
+        return promise;
+    }
+    it('should request device code and return tokens on immediate approval', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(tokenResponse),
+        });
+        const p = client.authorizeDevice();
+        await drainPolling(p);
+        expect(mockFetch).toHaveBeenCalledTimes(2);
+        const [deviceUrl, deviceOpts] = mockFetch.mock.calls[0];
+        expect(deviceUrl).toBe('https://api.test.com/v1/oauth/device/authorize');
+        expect(deviceOpts.body).toBeDefined();
+        expect(deviceOpts.body.toString()).toContain('client_id=2');
+        const [tokenUrl, tokenOpts] = mockFetch.mock.calls[1];
+        expect(tokenUrl).toBe('https://api.test.com/v1/oauth/token');
+        expect(tokenOpts.body).toBeDefined();
+        expect(tokenOpts.body.toString()).toContain('device_code=dev-code-123');
+        expect(saveTokens).toHaveBeenCalledWith(expect.objectContaining({
+            accessToken: 'access-123',
+            refreshToken: 'refresh-456',
+        }));
+    });
+    it('should poll on authorization_pending then succeed', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: false,
+            text: () => Promise.resolve(JSON.stringify({ error: 'authorization_pending' })),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(tokenResponse),
+        });
+        const p = client.authorizeDevice();
+        await drainPolling(p);
+        expect(mockFetch).toHaveBeenCalledTimes(3);
+        expect(saveTokens).toHaveBeenCalled();
+    });
+    it('should increase interval on slow_down then succeed', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: false,
+            text: () => Promise.resolve(JSON.stringify({ error: 'slow_down' })),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(tokenResponse),
+        });
+        const p = client.authorizeDevice();
+        await drainPolling(p);
+        expect(mockFetch).toHaveBeenCalledTimes(3);
+    });
+    it('should throw on access_denied', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: false,
+            text: () => Promise.resolve(JSON.stringify({ error: 'access_denied' })),
+        });
+        const p = client.authorizeDevice();
+        // Attach rejection handler before advancing timers to avoid unhandled rejection
+        const assertion = expect(p).rejects.toThrow('Authorization denied by user.');
+        await drainPolling(p).catch(() => { });
+        await assertion;
+    });
+    it('should throw on expired_token', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: false,
+            text: () => Promise.resolve(JSON.stringify({ error: 'expired_token' })),
+        });
+        const p = client.authorizeDevice();
+        const assertion = expect(p).rejects.toThrow('Device code expired');
+        await drainPolling(p).catch(() => { });
+        await assertion;
+    });
+    it('should handle non-JSON error response', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: false,
+            status: 502,
+            text: () => Promise.resolve('Bad Gateway'),
+        });
+        const p = client.authorizeDevice();
+        const assertion = expect(p).rejects.toThrow('Device flow polling failed');
+        await drainPolling(p).catch(() => { });
+        await assertion;
+    });
+    it('should throw when device authorize request fails', async () => {
+        mockFetch.mockResolvedValueOnce({
+            ok: false,
+            status: 400,
+            text: () => Promise.resolve('Bad Request'),
+        });
+        await expect(client.authorizeDevice()).rejects.toThrow('Device authorization request failed (400): Bad Request');
+    });
+});
+describe('OAuthClient.setTokens workspace persistence', () => {
+    let client;
+    beforeEach(() => {
+        vi.useFakeTimers();
+        vi.mocked(saveWorkspace).mockClear();
+        client = new OAuthClient({
+            clientId: '2',
+            authServerUrl: 'https://api.test.com',
+        });
+    });
+    afterEach(() => {
+        mockFetch.mockReset();
+        vi.useRealTimers();
+    });
+    it('persists workspace when device grant carries user.workspace_id', async () => {
+        const wsId = 'ws-device-abc';
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({
+                ...tokenResponse,
+                user: { workspace_id: wsId },
+                // Backend includes workspaces[] in the grant response but
+                // tq-oauth does not cache it locally — left here to simulate
+                // the full payload without asserting anything on it.
+                workspaces: [
+                    {
+                        id: wsId,
+                        name: 'My Workspace',
+                        url_key: 'my-ws',
+                        is_primary: true,
+                    },
+                ],
+            }),
+        });
+        const p = client.authorizeDevice();
+        for (let i = 0; i < 20; i++) {
+            await vi.advanceTimersByTimeAsync(6_000);
+        }
+        await p;
+        expect(saveWorkspace).toHaveBeenCalledTimes(1);
+        expect(saveWorkspace).toHaveBeenCalledWith(wsId);
+    });
+    it('does NOT persist workspace when grant omits user.workspace_id (refresh-like)', async () => {
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(deviceResponse),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve(tokenResponse),
+        });
+        const p = client.authorizeDevice();
+        for (let i = 0; i < 20; i++) {
+            await vi.advanceTimersByTimeAsync(6_000);
+        }
+        await p;
+        expect(saveWorkspace).not.toHaveBeenCalled();
+    });
+});
+describe('OAuthClient.refresh workspace behavior', () => {
+    let client;
+    beforeEach(() => {
+        vi.mocked(saveWorkspace).mockClear();
+        client = new OAuthClient({
+            clientId: '2',
+            authServerUrl: 'https://api.test.com',
+        });
+        // Seed a refresh token so refresh() proceeds to the fetch call
+        client.setTokensFromStorage({
+            accessToken: 'expired-access',
+            refreshToken: 'refresh-seed',
+            expiresAt: Date.now() - 1000,
+            apiBaseUrl: 'https://api.test.com',
+        });
+    });
+    afterEach(() => {
+        mockFetch.mockReset();
+    });
+    it('refresh response without user field does NOT save workspace', async () => {
+        mockFetch.mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({
+                access_token: 'new-access',
+                token_type: 'bearer',
+                expires_in: 3600,
+                refresh_token: 'new-refresh',
+                scope: 'read:own',
+            }),
+        });
+        await client.refresh();
+        expect(saveWorkspace).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=oauth-client.test.js.map

package/dist/oauth-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.test.js","sourceRoot":"","sources":["../src/oauth-client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGzE,+DAA+D;AAC/D,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;IACtB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;IACnB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,uBAAuB,EAAE,GAAG,EAAE,CAAC,KAAK;IACpC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;CAC3B,CAAC,CAAC,CAAC;AAEJ,gFAAgF;AAChF,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;IACzB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,oBAAoB,EAAE,GAAG,EAAE,CAAC,yBAAyB;CACtD,CAAC,CAAC,CAAC;AAEJ,4DAA4D;AAC5D,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,sBAAsB;QACjC,aAAa,EAAE,GAAG;KACnB,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAElC,MAAM,cAAc,GAAgC;IAClD,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,sCAAsC;IACxD,yBAAyB,EACvB,0DAA0D;IAC5D,UAAU,EAAE,GAAG;IACf,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,KAAK;IACjB,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,oBAAoB;CAC5B,CAAC;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,IAAI,MAAmB,CAAC;IAExB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,IAAI,WAAW,CAAC;YACvB,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,sBAAsB;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,SAAS,CAAC,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,KAAK,UAAU,YAAY,CAAC,OAAsB;QAChD,oEAAoE;QACpE,wDAAwD;QACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3C,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtB,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAGrD,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACzE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,CAAE,UAAU,CAAC,IAAwB,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAC/D,aAAa,CACd,CAAC;QAEF,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAGnD,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC7D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAE,SAAS,CAAC,IAAwB,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAC9D,0BAA0B,CAC3B,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CACrC,MAAM,CAAC,gBAAgB,CAAC;YACtB,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,aAAa;SAC5B,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;SACtE,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3C,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtB,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;SACpE,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3C,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtB,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;SACxE,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,gFAAgF;QAChF,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACzC,+BAA+B,CAChC,CAAC;QACF,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;SACxE,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3C,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,SAAS,CAAC,qBAAqB,CAAC;YAC9B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3C,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CACpD,wDAAwD,CACzD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,MAAmB,CAAC;IAExB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,IAAI,WAAW,CAAC;YACvB,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,sBAAsB;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,SAAS,CAAC,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,IAAI,GAAG,eAAe,CAAC;QAC7B,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,GAAG,aAAa;gBAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC5B,0DAA0D;gBAC1D,6DAA6D;gBAC7D,qDAAqD;gBACrD,UAAU,EAAE;oBACV;wBACE,EAAE,EAAE,IAAI;wBACR,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,OAAO;wBAChB,UAAU,EAAE,IAAI;qBACjB;iBACF;aACF,CAAC;SACL,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,CAAC;QAER,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;SAC5C,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3C,CAAC,CAAC;QAEL,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,CAAC;QAER,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,IAAI,MAAmB,CAAC;IAExB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,IAAI,WAAW,CAAC;YACvB,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,sBAAsB;SACtC,CAAC,CAAC;QACH,+DAA+D;QAC/D,MAAM,CAAC,oBAAoB,CAAC;YAC1B,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,cAAc;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,UAAU,EAAE,sBAAsB;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,SAAS,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,SAAS,CAAC,qBAAqB,CAAC;YAC9B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,YAAY,EAAE,YAAY;gBAC1B,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,aAAa;gBAC5B,KAAK,EAAE,UAAU;aAClB,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAEvB,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test-utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared test utilities for tq-oauth tests.
+ */
+/**
+ * Temporarily simulate a non-test environment so loadConfig()
+ * exercises the config-file reading path. loadConfig() skips
+ * ~/.tq/config.json when VITEST/JEST env vars are set.
+ */
+export declare function withNonTestEnv<T>(fn: () => T): T;
+//# sourceMappingURL=test-utils.d.ts.map

package/dist/test-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-utils.d.ts","sourceRoot":"","sources":["../src/test-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CA2BhD"}

package/dist/test-utils.js

@@ -0,0 +1,45 @@
+/**
+ * Shared test utilities for tq-oauth tests.
+ */
+/**
+ * Temporarily simulate a non-test environment so loadConfig()
+ * exercises the config-file reading path. loadConfig() skips
+ * ~/.tq/config.json when VITEST/JEST env vars are set.
+ */
+export function withNonTestEnv(fn) {
+    const saved = {
+        VITEST: process.env.VITEST,
+        NODE_ENV: process.env.NODE_ENV,
+        JEST_WORKER_ID: process.env.JEST_WORKER_ID,
+        // DEV_TLS gates isLocalTlsMode() in config.ts. Clearing it forces the
+        // cert-file probe path, which deterministically returns false in the
+        // tmpDir filesystem the test harness uses.
+        DEV_TLS: process.env.DEV_TLS,
+    };
+    delete process.env.VITEST;
+    process.env.NODE_ENV = 'development';
+    delete process.env.JEST_WORKER_ID;
+    delete process.env.DEV_TLS;
+    try {
+        return fn();
+    }
+    finally {
+        if (saved.VITEST !== undefined)
+            process.env.VITEST = saved.VITEST;
+        else
+            delete process.env.VITEST;
+        if (saved.NODE_ENV !== undefined)
+            process.env.NODE_ENV = saved.NODE_ENV;
+        else
+            delete process.env.NODE_ENV;
+        if (saved.JEST_WORKER_ID !== undefined)
+            process.env.JEST_WORKER_ID = saved.JEST_WORKER_ID;
+        else
+            delete process.env.JEST_WORKER_ID;
+        if (saved.DEV_TLS !== undefined)
+            process.env.DEV_TLS = saved.DEV_TLS;
+        else
+            delete process.env.DEV_TLS;
+    }
+}
+//# sourceMappingURL=test-utils.js.map

package/dist/test-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-utils.js","sourceRoot":"","sources":["../src/test-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAI,EAAW;IAC3C,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;QAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC9B,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,sEAAsE;QACtE,qEAAqE;QACrE,2CAA2C;QAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;KAC7B,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;;YAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;;YACnE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YACpC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;;YAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;;YAChE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/token-store.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Secure token storage for OAuth tokens
+ *
+ * Stores tokens in ~/.tq/oauth-tokens.json as a map keyed by backend URL:
+ * {
+ *   "https://api.levr.now": { accessToken, refreshToken, expiresAt, apiBaseUrl },
+ *   "http://localhost:8080": { ... }
+ * }
+ *
+ * Backward-compatible: if the file contains the legacy single-token format
+ * (flat object with accessToken at the top level), it is migrated in-place
+ * to the new map format on first read.
+ */
+import type { StoredTokens } from './types.js';
+export type EnvName = 'local' | 'staging' | 'production';
+/**
+ * Resolve an environment name from a backend URL.
+ * Returns undefined if the URL doesn't match any known preset.
+ */
+export declare function resolveEnvFromUrl(url: string): EnvName | undefined;
+/**
+ * Resolve a backend URL from an environment name.
+ */
+export declare function resolveUrlFromEnv(env: EnvName): string;
+/**
+ * Load the token for the current environment.
+ * Reads the config to determine which backend URL is active,
+ * then returns the matching entry from the token map.
+ *
+ * Falls back to first token in the map ONLY when no config exists
+ * (backward compat for first-time migration). When the user has
+ * explicitly set an environment, only that environment's token is returned.
+ */
+export declare function loadTokens(): StoredTokens | null;
+/**
+ * Load tokens for a specific environment by name.
+ */
+export declare function loadTokensForEnv(env: EnvName): StoredTokens | null;
+/**
+ * Load tokens for an arbitrary backend URL (custom URL not in ENV_URLS).
+ *
+ * Used by the qinetic sync setup command, which needs to talk to a remote
+ * backend that may not be one of the named presets — the operator passes
+ * `--target <url>` and the CLI fetches the matching token entry by URL.
+ */
+export declare function loadTokensForUrl(url: string): StoredTokens | null;
+/**
+ * Save tokens for the current environment.
+ * Upserts the entry keyed by the token's apiBaseUrl.
+ */
+export declare function saveTokens(tokens: StoredTokens): void;
+/**
+ * Save tokens for a specific environment by name.
+ */
+export declare function saveTokensForEnv(env: EnvName, tokens: StoredTokens): void;
+/**
+ * Clear stored tokens for the current environment.
+ * Moves the entire file to .bak before removing the entry.
+ */
+export declare function clearTokens(): void;
+/**
+ * Attempt to restore tokens from backup (.bak file)
+ * Returns true if backup was restored successfully.
+ */
+export declare function restoreTokensFromBackup(): boolean;
+/**
+ * Check if token file exists and has any entries
+ */
+export declare function hasStoredTokens(): boolean;
+/**
+ * Get token file path (for debugging and watching)
+ */
+export declare function getTokenFilePath(): string;
+/**
+ * Get TQ directory path
+ */
+export declare function getTqDir(): string;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;AAyBzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAMlE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEtD;AAwDD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,YAAY,GAAG,IAAI,CAmBhD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAMlE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOjE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAUrD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAIzE;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,IAAI,CA6BlC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAiCjD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAIzC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAEjC"}