@littlebearapps/outlook-assistant 3.12.1 → 3.14.0

package/auth/token-storage.js

@@ -3,7 +3,9 @@ const fsSync = require('fs');
 const path = require('path');
 const https = require('https');
 const querystring = require('querystring');
-const { describeAuthError } = require('./auth-errors');
+const { describeAuthError, authErrorLogLabel } = require('./auth-errors');
+const { resolveClientId } = require('./client-config');
+const { log } = require('../utils/logger');
 
 /**
  * Decide which scopes a refresh request should use. Prefer the scopes that were
@@ -42,7 +44,9 @@ class TokenStorage {
         process.env.HOME || process.env.USERPROFILE,
         '.outlook-assistant-tokens.json'
       ),
-      clientId: process.env.OUTLOOK_CLIENT_ID || process.env.MS_CLIENT_ID,
+      // No default clientId: when none is passed, getClientId() resolves it on
+      // every use (env → saved ~/.outlook-assistant-config.json), so an ID
+      // saved at runtime via the auth tool takes effect without a restart.
       clientSecret:
         process.env.OUTLOOK_CLIENT_SECRET || process.env.MS_CLIENT_SECRET,
       redirectUri:
@@ -80,7 +84,7 @@ class TokenStorage {
       }
     }
 
-    if (!this.config.clientId) {
+    if (!this.getClientId()) {
       console.warn(
         'TokenStorage: OUTLOOK_CLIENT_ID is not configured. Token operations will fail.'
       );
@@ -89,6 +93,15 @@ class TokenStorage {
     // Device code flow (public client) does not use client_secret.
   }
 
+  /**
+   * Client ID for token requests: an explicitly configured value wins,
+   * otherwise it is resolved now (OUTLOOK_CLIENT_ID → MS_CLIENT_ID → saved).
+   * @returns {string}
+   */
+  getClientId() {
+    return this.config.clientId || resolveClientId();
+  }
+
   async _loadTokensFromFile() {
     try {
       const tokenData = await fs.readFile(this.config.tokenStorePath, 'utf8');
@@ -96,7 +109,8 @@ class TokenStorage {
       return this.tokens;
     } catch (error) {
       if (error.code !== 'ENOENT') {
-        console.error('Error loading token cache:', error.message);
+        log.note('auth', 'token-cache-unreadable');
+        log.debug('Error loading token cache:', error.message);
       }
       this.tokens = null;
       return null;
@@ -114,7 +128,8 @@ class TokenStorage {
         { mode: 0o600 }
       );
     } catch (error) {
-      console.error('Error saving token cache:', error.message);
+      log.note('auth', 'token-cache-save-failed');
+      log.debug('Error saving token cache:', error.message);
       throw error;
     }
   }
@@ -149,19 +164,20 @@ class TokenStorage {
     await this.getTokens(); // Ensure tokens are loaded
 
     if (!this.tokens || !this.tokens.access_token) {
-      console.log('No access token available.');
+      log.debug('No access token available.');
       return null;
     }
 
     if (this.isTokenExpired()) {
-      console.log(
+      log.debug(
         'Access token expired or nearing expiration. Attempting refresh.'
       );
       if (this.tokens.refresh_token) {
         try {
           return await this.refreshAccessToken();
         } catch (refreshError) {
-          console.error('Failed to refresh access token:', refreshError);
+          log.note('auth', authErrorLogLabel('refresh-failed', refreshError));
+          log.debug('Failed to refresh access token:', refreshError);
           // Drop the in-memory tokens so callers re-authenticate. The save
           // below is intentionally a no-op — `_saveTokensToFile` returns early
           // when `tokens` is null — which is the behaviour we want: a transient
@@ -172,9 +188,8 @@ class TokenStorage {
           return null;
         }
       } else {
-        console.warn(
-          'No refresh token available. Cannot refresh access token.'
-        );
+        log.note('auth', 'no-refresh-token');
+        log.debug('No refresh token available. Cannot refresh access token.');
         // Same as above: clears memory, leaves the file alone. (#72)
         this.tokens = null;
         await this._saveTokensToFile();
@@ -193,7 +208,7 @@ class TokenStorage {
 
     // Prevent multiple concurrent refresh attempts
     if (this._refreshPromise) {
-      console.log('Refresh already in progress, returning existing promise.');
+      log.debug('Refresh already in progress, returning existing promise.');
       return this._refreshPromise.then((tokens) => tokens.access_token);
     }
 
@@ -201,12 +216,12 @@ class TokenStorage {
     // in refresh requests for tokens obtained via device code.
     // Browser flow (confidential client) requires client_secret.
     const isDeviceCode = this.tokens.auth_method === 'device-code';
-    console.log(
+    log.debug(
       `Attempting to refresh access token (auth_method: ${this.tokens.auth_method || 'browser'})...`
     );
 
     const refreshParams = {
-      client_id: this.config.clientId,
+      client_id: this.getClientId(),
       grant_type: 'refresh_token',
       refresh_token: this.tokens.refresh_token,
       // Use the GRANTED scopes, not the full configured set. After a base-only
@@ -247,10 +262,10 @@ class TokenStorage {
                   Date.now() + responseBody.expires_in * 1000;
                 try {
                   await this._saveTokensToFile();
-                  console.log('Access token refreshed and saved successfully.');
+                  log.debug('Access token refreshed and saved successfully.');
                   resolve(this.tokens);
                 } catch (saveError) {
-                  console.error('Failed to save refreshed tokens:', saveError);
+                  log.debug('Failed to save refreshed tokens:', saveError);
                   // Even if save fails, tokens are updated in memory.
                   // Depending on desired strictness, could reject here.
                   // For now, resolve with in-memory tokens but log critical error.
@@ -262,7 +277,7 @@ class TokenStorage {
                   );
                 }
               } else {
-                console.error('Error refreshing token:', responseBody);
+                log.debug('Error refreshing token:', responseBody);
                 reject(
                   new Error(
                     describeAuthError(
@@ -274,7 +289,7 @@ class TokenStorage {
               }
             } catch (e) {
               // Catch any error during parsing or saving
-              console.error(
+              log.debug(
                 'Error processing refresh token response or saving tokens:',
                 e
               );
@@ -286,7 +301,7 @@ class TokenStorage {
         }
       );
       req.on('error', (error) => {
-        console.error('HTTP error during token refresh:', error);
+        log.debug('HTTP error during token refresh:', error);
         reject(error);
         this._refreshPromise = null; // Clear promise on error
       });
@@ -298,15 +313,16 @@ class TokenStorage {
   }
 
   async exchangeCodeForTokens(authCode) {
-    if (!this.config.clientId || !this.config.clientSecret) {
+    const clientId = this.getClientId();
+    if (!clientId || !this.config.clientSecret) {
       throw new Error(
         'Client ID or Client Secret is not configured. Cannot exchange code for tokens.'
       );
     }
-    console.log('Exchanging authorization code for tokens...');
+    log.debug('Exchanging authorization code for tokens...');
     const requestedScopes = this.config.scopes;
     const postData = querystring.stringify({
-      client_id: this.config.clientId,
+      client_id: clientId,
       client_secret: this.config.clientSecret,
       grant_type: 'authorization_code',
       code: authCode,
@@ -351,10 +367,10 @@ class TokenStorage {
                 };
                 try {
                   await this._saveTokensToFile();
-                  console.log('Tokens exchanged and saved successfully.');
+                  log.debug('Tokens exchanged and saved successfully.');
                   resolve(this.tokens);
                 } catch (saveError) {
-                  console.error('Failed to save exchanged tokens:', saveError);
+                  log.debug('Failed to save exchanged tokens:', saveError);
                   // Similar to refresh, tokens are in memory but not persisted.
                   // Rejecting to indicate the operation wasn't fully successful.
                   reject(
@@ -364,10 +380,7 @@ class TokenStorage {
                   );
                 }
               } else {
-                console.error(
-                  'Error exchanging code for tokens:',
-                  responseBody
-                );
+                log.debug('Error exchanging code for tokens:', responseBody);
                 reject(
                   new Error(
                     describeAuthError(
@@ -379,7 +392,7 @@ class TokenStorage {
               }
             } catch (e) {
               // Catch any error during parsing or saving
-              console.error(
+              log.debug(
                 'Error processing token exchange response or saving tokens:',
                 e,
                 'Raw data:',
@@ -395,7 +408,7 @@ class TokenStorage {
         }
       );
       req.on('error', (error) => {
-        console.error('HTTP error during code exchange:', error);
+        log.debug('HTTP error during code exchange:', error);
         reject(error);
       });
       req.write(postData);
@@ -408,12 +421,12 @@ class TokenStorage {
     this.tokens = null;
     try {
       await fs.unlink(this.config.tokenStorePath);
-      console.log('Token file deleted successfully.');
+      log.debug('Token file deleted successfully.');
     } catch (error) {
       if (error.code === 'ENOENT') {
-        console.log('Token file not found, nothing to delete.');
+        log.debug('Token file not found, nothing to delete.');
       } else {
-        console.error('Error deleting token file:', error);
+        log.debug('Error deleting token file:', error);
       }
     }
   }