@magpie-community/opencode-workbuddy-auth 0.1.6 → 0.1.7

package/README.md

@@ -33,6 +33,16 @@ marker, `{"type": "oauth", "source": "desktop", "accountId", "uid"}`. OpenCode k
 refreshed a minute before it ends, and the new one is saved. If the refresh
 fails, the old token is used while it lasts.
 
+In magpie (0.1.684 or later) the plugin also gives `auth.refresh` with
+`refreshLead` of 5 minutes: magpie renews a browser sign-in (an hour's
+token) 5 minutes before it ends, once for the account, before its
+requests, models and usage ask, and saves what it gives. It goes through
+the same one-refresh-at-a-time as a request's refresh, so a refresh token
+is never spent twice. A failed renewal, a refresh token past its end
+included, doesn't mark the account, as the built-in never did; magpie
+tries again later, and the old token is used meanwhile.
+OpenCode doesn't call `auth.refresh`; the check before each request stays.
+
 Desktop's sign-in is refreshed only when the app hasn't refreshed it
 itself, and the new token is kept in memory, never written back, as magpie's
 built-in WorkBuddy does.

package/index.mjs

@@ -17,7 +17,9 @@ const APP_VERSION = "2.0.0" // the version WorkBuddy's sign-in page is opened wi
 const UA_VERSION = "5.5.6" // WorkBuddy/<this> is the User-Agent the API takes
 const POLL_MS = 1000
 const SIGN_IN_MS = 5 * 60 * 1000
-const EARLY_MS = 60 * 1000 // a token this close to its end is refreshed
+const EARLY_MS = 60 * 1000 // a token this close to its end is refreshed before a request
+const LEAD_MS = 5 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
+const KEEP_RENEWED_MS = 60 * 1000 // how long a refresh's result answers for the old refresh token
 
 // [id, name, context, efforts]
 const CN_MODELS = [
@@ -146,27 +148,66 @@ function stale(a) {
   return !!a.expires && Date.now() >= a.expires - EARLY_MS
 }
 
+// renewing is each refresh under way, by site and the refresh token it
+// spends; renewed is what each gave, kept a minute so one that read the
+// old refresh token after it was spent (magpie's auth.refresh, a request)
+// takes that rather than spending it again.
+const renewing = new Map()
+const renewed = new Map()
+
+function refreshable(a) {
+  return !!a.refresh && !(a.refreshExpiresAt && Date.now() >= a.refreshExpiresAt)
+}
+
+// renew spends a's refresh token, once: those who come while it runs, or
+// within KEEP_RENEWED_MS of it, get what it gave. save keeps the result.
+function renew(site, a, save) {
+  const key = site.id + "\n" + a.refresh
+  const done = renewed.get(key)
+  if (done && Date.now() - done.at < KEEP_RENEWED_MS) return Promise.resolve(merged(a, done.next))
+  let r = renewing.get(key)
+  if (!r) {
+    r = (async () => {
+      const got = await call(site, "POST", "/v2/plugin/auth/token/refresh", {
+        "X-Refresh-Token": a.refresh,
+        "X-Auth-Refresh-Source": "plugin",
+        "X-Domain": domainOf(site, a),
+      }, {})
+      if (!got?.accessToken) throw Object.assign(new Error("WorkBuddy gave no refreshed token"), { bare: true })
+      const next = merge(a, got)
+      renewed.set(key, { next, at: Date.now() })
+      await save?.(next)
+      return next
+    })().finally(() => renewing.delete(key))
+    renewing.set(key, r)
+  }
+  return r.then((next) => merged(a, next))
+}
+
+// merged is a with the tokens another's refresh gave over it.
+function merged(a, next) {
+  const out = { ...a }
+  for (const k of TOKEN_FIELDS) if (k in next) out[k] = next[k]
+  return out
+}
+const TOKEN_FIELDS = ["access", "refresh", "expires", "refreshExpiresAt", "domain", "tokenType"]
+
 // fresh is the sign-in with an access token that isn't about to end:
 // refreshed (and saved) when it is. A refresh that fails, or a refresh
 // token that has ended, leaves the access token there is. Its failures
 // are worded as the built-in's (wbFresh), "WorkBuddy" on both sites.
 async function fresh(site, client, a) {
   if (!stale(a)) return a
-  const refreshable = a.refresh && !(a.refreshExpiresAt && Date.now() >= a.refreshExpiresAt)
-  if (!refreshable) {
+  if (!refreshable(a)) {
     if (a.access) return a
     throw new Error("this WorkBuddy account is signed out; sign in again")
   }
   try {
-    const got = await call(site, "POST", "/v2/plugin/auth/token/refresh", {
-      "X-Refresh-Token": a.refresh,
-      "X-Auth-Refresh-Source": "plugin",
-      "X-Domain": domainOf(site, a),
-    }, {})
-    if (!got?.accessToken) throw Object.assign(new Error("WorkBuddy gave no refreshed token"), { bare: true })
-    const next = merge(a, got)
-    await client?.auth?.set?.({ path: { id: site.id }, body: next })
-    return next
+    return await renew(site, a, async (next) => {
+      try {
+        await client?.auth?.set?.({ path: { id: site.id }, body: next })
+      } catch {}
+    })
   } catch (e) {
     if (a.access) return a
     if (e?.bare) throw e
@@ -174,6 +215,26 @@ async function fresh(site, client, a) {
   }
 }
 
+// refreshed is what magpie's auth.refresh gives for a browser sign-in:
+// the fields a refresh changed, nothing when there's nothing to renew.
+// magpie saves them itself.
+async function refreshed(site, auth) {
+  if (auth?.type !== "oauth" || auth.source === "desktop" || !auth.access || !auth.refresh) return undefined
+  // a refresh token that has ended is said plainly, never as signIn
+  // "expired": the built-in never marked a WorkBuddy account
+  if (!refreshable(auth)) throw new Error("this WorkBuddy account is signed out; sign in again")
+  let next
+  try {
+    next = await renew(site, auth)
+  } catch (e) {
+    if (e?.bare) throw e
+    throw new Error(`WorkBuddy token refresh: ${e?.said ?? e?.message ?? e}`)
+  }
+  const out = {}
+  for (const k of TOKEN_FIELDS) if (k in next && next[k] !== auth[k]) out[k] = next[k]
+  return Object.keys(out).length ? out : undefined
+}
+
 // sign sets on headers what WorkBuddy's desktop app sends with a chat.
 function sign(site, a, headers) {
   headers.set("Authorization", "Bearer " + a.access)
@@ -571,6 +632,13 @@ function makePlugin(site) {
     },
     auth: {
       provider: site.id,
+      // magpie renews a browser sign-in LEAD_MS before its end (an hour's
+      // token), once for the account, before its requests, models and
+      // usage ask; the check before each request stays for OpenCode,
+      // which doesn't call this. Desktop's sign-in has no expiry stored
+      // and is renewed as before.
+      refreshLead: LEAD_MS,
+      refresh: (auth) => refreshed(site, auth),
       async loader(getAuth) {
         const auth = await getAuth()
         if (auth?.type !== "oauth") return {}
@@ -676,4 +744,4 @@ export const WorkBuddyAuthPlugin = makePlugin(SITES.workbuddy)
 export const WorkBuddyAIAuthPlugin = makePlugin(SITES["workbuddy-ai"])
 
 // for tests
-export const _internal = { withSystem, usageOf, desktopHeld, explained, REFUSED_HINT, freeCredits, creditsOf, fresh, SITES }
+export const _internal = { withSystem, usageOf, desktopHeld, explained, REFUSED_HINT, freeCredits, creditsOf, fresh, SITES, renewing, renewed }

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@magpie-community/opencode-workbuddy-auth",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "OpenCode provider plugins for WorkBuddy's plans: WorkBuddy (CodeBuddy, copilot.tencent.com) and WorkBuddy AI (www.workbuddy.ai)",
   "type": "module",
   "main": "./index.mjs",
   "exports": "./index.mjs",
   "files": ["index.mjs", "README.md"],
   "keywords": ["opencode", "opencode-plugin", "workbuddy", "codebuddy"],
-  "license": "MIT"
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/magpie-community/plugins.git", "directory": "packages/workbuddy" }
 }