@livedesk/hub 0.1.45 → 0.1.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.45",
+  "version": "0.1.46",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/src/server.js

@@ -513,11 +513,19 @@ async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
-  if (accessToken && !expiresSoon) {
-    return accessToken;
-  }
-
-  const refreshToken = String(runtimeRefreshToken || '').trim();
+  if (accessToken && !expiresSoon) {
+    return accessToken;
+  }
+
+  // The packaged Electron main process owns the encrypted refresh token and
+  // proactively sends each rotation to this child runtime. A second refresh
+  // owner here could consume the one-time token first and make the desktop
+  // shell appear signed out after sleep.
+  if (desktopMainAuthConfig) {
+    return accessToken;
+  }
+
+  const refreshToken = String(runtimeRefreshToken || '').trim();
   if (!refreshToken) {
     return accessToken;
   }
@@ -621,9 +629,9 @@ async function queryAuthoritativeRuntimeRole() {
     },
     SUPABASE_AUTH_TIMEOUT_MS
   );
-  if (response.status === 401 || response.status === 403) {
-    clearRuntimeSession();
-    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    if (!desktopMainAuthConfig) clearRuntimeSession();
+    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`hub-role-query-failed:${response.status}`);
@@ -4601,9 +4609,9 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   );
   const data = await response.json().catch(() => null);
   const result = Array.isArray(data) ? data[0] : data;
-  if (response.status === 401 || response.status === 403) {
-    clearRuntimeSession();
-    throw new Error(`${name}-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    if (!desktopMainAuthConfig) clearRuntimeSession();
+    throw new Error(`${name}-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`${name}-failed:${response.status}`);