@mathismeadows/roamer-device-auth 1.5.1 → 1.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -111,6 +111,29 @@ function identityLabelFromTokens(tokens) {
   return payload?.email ?? payload?.preferred_username ?? payload?.oid ?? null;
 }
 
+// AUTH-59: RoamerMcp-issued access tokens only ever carry oid/tid (see
+// OAuthAuthorizationServerService.IssueAccessToken) — identityLabelFromTokens' email/
+// preferred_username branches above are therefore dead in production, and every operator-
+// facing label resolves to the raw oid without this. Resolves a human-readable label live
+// from RoamerMcp's own Portal API instead, without ever persisting the result — only the
+// oid-based fallback above is ever written to disk. Never throws: offline, a timed-out
+// request, an expired/revoked token, or a non-200 response all just mean "no live label this
+// time", same degrade-gracefully convention this file uses everywhere else.
+async function fetchLiveLabel(accessToken) {
+  if (!accessToken) return null;
+  try {
+    const response = await fetch(`${ROAMER_MCP_ORIGIN}/api/portal/tenant-state`, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(3000),
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return data?.displayName || data?.email || null;
+  } catch {
+    return null;
+  }
+}
+
 function decodeTokenPayload(tokens) {
   try {
     return JSON.parse(Buffer.from(tokens.access_token.split(".")[1], "base64url").toString("utf8"));
@@ -148,6 +171,20 @@ function clearActiveIdentity(clientSlug) {
   return unlink(path).catch(() => {});
 }
 
+// AUTH-59: reads whichever of the two token-cache files exists for a given identity, so
+// logoutCommand's default (active-only) path can resolve a live display label — from the
+// access_token that file holds — before it deletes that same file.
+async function readAnyTokensForIdentity(clientSlug, identityKey) {
+  for (const baseName of ["roamer_tokens", "roamer_loopback_tokens"]) {
+    try {
+      return JSON.parse(await readFile(cacheFilePath(baseName, clientSlug, identityKey), "utf8"));
+    } catch {
+      // try the other mechanism
+    }
+  }
+  return null;
+}
+
 // AUTH-58: lists every identity currently cached for a client slug, across both auth
 // mechanisms (a machine's default browser — and therefore which mechanism is in play — can
 // change over time; a person could have identities cached under either). Reads each file's own
@@ -156,7 +193,7 @@ function clearActiveIdentity(clientSlug) {
 async function listCachedIdentities(clientSlug) {
   const active = await readActiveIdentity(clientSlug);
   const prefixes = [`roamer_tokens__${clientSlug}__`, `roamer_loopback_tokens__${clientSlug}__`];
-  const seen = new Map(); // identityKey -> label, deduped across the two mechanisms
+  const seen = new Map(); // identityKey -> { label, accessToken }, deduped across the two mechanisms
   let entries;
   try {
     entries = await readdir(CACHE_DIR);
@@ -170,16 +207,20 @@ async function listCachedIdentities(clientSlug) {
     if (!identityKey || seen.has(identityKey)) continue;
     try {
       const contents = JSON.parse(await readFile(join(CACHE_DIR, entry), "utf8"));
-      seen.set(identityKey, contents?.label ?? identityKey);
+      seen.set(identityKey, { label: contents?.label ?? identityKey, accessToken: contents?.access_token ?? null });
     } catch {
-      seen.set(identityKey, identityKey);
+      seen.set(identityKey, { label: identityKey, accessToken: null });
     }
   }
-  return [...seen.entries()].map(([identityKey, label]) => ({
-    identityKey,
-    label,
-    active: identityKey === active?.identityKey,
-  }));
+  // AUTH-59: resolved in parallel, live, on every call — never persisted back to `seen`'s
+  // source files.
+  return Promise.all(
+    [...seen.entries()].map(async ([identityKey, { label, accessToken }]) => ({
+      identityKey,
+      label: (await fetchLiveLabel(accessToken)) ?? label,
+      active: identityKey === active?.identityKey,
+    })),
+  );
 }
 
 // AUTH-55/57/58: login/logout/status run standalone, with no MCP `initialize` handshake to
@@ -197,8 +238,20 @@ async function listKnownClientSlugs() {
   for (const entry of entries) {
     // Safe to split on "__" without ambiguity: neither a client slug (clientSlugFromInitializeLine)
     // nor an identity key (identityKeyFromTokens) can contain an underscore post-sanitization.
-    const match = entry.match(/^roamer_(?:tokens|loopback_tokens)__([^_]+)__/);
-    if (match) slugs.add(match[1]);
+    const withIdentity = entry.match(/^roamer_(?:tokens|loopback_tokens)__([^_]+)__/);
+    if (withIdentity) {
+      slugs.add(withIdentity[1]);
+      continue;
+    }
+    // BUG (found live 2026-09-08, caused a real cross-session logout): a slug that has never
+    // reconnected since AUTH-54 shipped only has the pre-AUTH-54 legacy file — no identity
+    // segment at all — and was invisible here. login/logout's own "if status lists exactly one
+    // slug, there's no ambiguity" reasoning then wrongly treated a real, actively-used client as
+    // nonexistent, silently acting on a *different* session's slug instead because it was the
+    // only one that happened to already be migrated. A legacy-only slug must still count as a
+    // real, known candidate even though it has no identity cached under the new scheme yet.
+    const legacy = entry.match(/^roamer_(?:tokens|loopback_tokens)__([^_]+)\.json$/);
+    if (legacy) slugs.add(legacy[1]);
   }
   return [...slugs].sort();
 }
@@ -965,7 +1018,10 @@ async function main() {
     const result = await getFreshTokens(clientSlug);
     tokens = result.tokens;
     reusedSilently = result.reusedSilently;
-    identityLabel = result.label;
+    // AUTH-59: live lookup on every run, bounded by fetchLiveLabel's own short timeout — this
+    // adds a network round trip to every ordinary client startup in exchange for a readable
+    // log line; falls back to the existing oid-based label on any failure.
+    identityLabel = (await fetchLiveLabel(result.tokens?.access_token)) ?? result.label;
   } catch (err) {
     // Sign-in genuinely failed (denied/expired), not just slow — every message queued while
     // we waited, starting with `initialize`, gets a real JSON-RPC error so the host sees an
@@ -1055,7 +1111,8 @@ async function loginCommand(args) {
   const getFreshTokens = isSafari ? getValidTokens : getValidTokensLoopback;
   try {
     const result = await getFreshTokens(clientSlug, false, /* forceFreshLogin */ true);
-    log(`Signed in as ${result.label ?? "(no identity claim found on the token)"} — now the active identity for "${clientSlug}".`);
+    const displayLabel = (await fetchLiveLabel(result.tokens?.access_token)) ?? result.label;
+    log(`Signed in as ${displayLabel ?? "(no identity claim found on the token)"} — now the active identity for "${clientSlug}".`);
   } catch (err) {
     log(`Login failed: ${err.message}`);
     process.exitCode = 1;
@@ -1092,12 +1149,15 @@ async function logoutCommand(args) {
     log(`"${clientSlug}" has no active identity to log out of.`);
     return;
   }
+  // AUTH-59: resolved before deletion, from the very cache file about to be removed.
+  const cachedTokens = await readAnyTokensForIdentity(clientSlug, active.identityKey);
+  const displayLabel = (await fetchLiveLabel(cachedTokens?.access_token)) ?? active.label;
   await Promise.all([
     deleteCacheFile(cacheFilePath("roamer_tokens", clientSlug, active.identityKey)),
     deleteCacheFile(cacheFilePath("roamer_loopback_tokens", clientSlug, active.identityKey)),
   ]);
   await clearActiveIdentity(clientSlug);
-  log(`Logged out ${active.label} for "${clientSlug}". Its next launch will sign in fresh, exactly like a first-ever run.`);
+  log(`Logged out ${displayLabel} for "${clientSlug}". Its next launch will sign in fresh, exactly like a first-ever run.`);
 }
 
 // AUTH-58: --client lists that one slug's cached identities; omitting it surveys every client