@mathismeadows/roamer-device-auth 1.5.2 → 1.5.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -111,6 +111,29 @@ function identityLabelFromTokens(tokens) {
   return payload?.email ?? payload?.preferred_username ?? payload?.oid ?? null;
 }
 
+// AUTH-59: RoamerMcp-issued access tokens only ever carry oid/tid (see
+// OAuthAuthorizationServerService.IssueAccessToken) — identityLabelFromTokens' email/
+// preferred_username branches above are therefore dead in production, and every operator-
+// facing label resolves to the raw oid without this. Resolves a human-readable label live
+// from RoamerMcp's own Portal API instead, without ever persisting the result — only the
+// oid-based fallback above is ever written to disk. Never throws: offline, a timed-out
+// request, an expired/revoked token, or a non-200 response all just mean "no live label this
+// time", same degrade-gracefully convention this file uses everywhere else.
+async function fetchLiveLabel(accessToken) {
+  if (!accessToken) return null;
+  try {
+    const response = await fetch(`${ROAMER_MCP_ORIGIN}/api/portal/tenant-state`, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(3000),
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return data?.displayName || data?.email || null;
+  } catch {
+    return null;
+  }
+}
+
 function decodeTokenPayload(tokens) {
   try {
     return JSON.parse(Buffer.from(tokens.access_token.split(".")[1], "base64url").toString("utf8"));
@@ -148,6 +171,20 @@ function clearActiveIdentity(clientSlug) {
   return unlink(path).catch(() => {});
 }
 
+// AUTH-59: reads whichever of the two token-cache files exists for a given identity, so
+// logoutCommand's default (active-only) path can resolve a live display label — from the
+// access_token that file holds — before it deletes that same file.
+async function readAnyTokensForIdentity(clientSlug, identityKey) {
+  for (const baseName of ["roamer_tokens", "roamer_loopback_tokens"]) {
+    try {
+      return JSON.parse(await readFile(cacheFilePath(baseName, clientSlug, identityKey), "utf8"));
+    } catch {
+      // try the other mechanism
+    }
+  }
+  return null;
+}
+
 // AUTH-58: lists every identity currently cached for a client slug, across both auth
 // mechanisms (a machine's default browser — and therefore which mechanism is in play — can
 // change over time; a person could have identities cached under either). Reads each file's own
@@ -156,7 +193,7 @@ function clearActiveIdentity(clientSlug) {
 async function listCachedIdentities(clientSlug) {
   const active = await readActiveIdentity(clientSlug);
   const prefixes = [`roamer_tokens__${clientSlug}__`, `roamer_loopback_tokens__${clientSlug}__`];
-  const seen = new Map(); // identityKey -> label, deduped across the two mechanisms
+  const seen = new Map(); // identityKey -> { label, accessToken }, deduped across the two mechanisms
   let entries;
   try {
     entries = await readdir(CACHE_DIR);
@@ -170,16 +207,20 @@ async function listCachedIdentities(clientSlug) {
     if (!identityKey || seen.has(identityKey)) continue;
     try {
       const contents = JSON.parse(await readFile(join(CACHE_DIR, entry), "utf8"));
-      seen.set(identityKey, contents?.label ?? identityKey);
+      seen.set(identityKey, { label: contents?.label ?? identityKey, accessToken: contents?.access_token ?? null });
     } catch {
-      seen.set(identityKey, identityKey);
+      seen.set(identityKey, { label: identityKey, accessToken: null });
     }
   }
-  return [...seen.entries()].map(([identityKey, label]) => ({
-    identityKey,
-    label,
-    active: identityKey === active?.identityKey,
-  }));
+  // AUTH-59: resolved in parallel, live, on every call — never persisted back to `seen`'s
+  // source files.
+  return Promise.all(
+    [...seen.entries()].map(async ([identityKey, { label, accessToken }]) => ({
+      identityKey,
+      label: (await fetchLiveLabel(accessToken)) ?? label,
+      active: identityKey === active?.identityKey,
+    })),
+  );
 }
 
 // AUTH-55/57/58: login/logout/status run standalone, with no MCP `initialize` handshake to
@@ -865,6 +906,37 @@ async function forwardLine(transport, line, getTokens, setTokens, getFreshTokens
   }
 }
 
+// AUTH-60: a reserved, locally-answered resource — never forwarded to the real upstream
+// server. Lets the exact connection asking report its own resolved clientSlug/identityLabel
+// back through the MCP session itself, with no external file or PID correlation required
+// (see AUTH-60's notes for why a file-based "list live connections" design was rejected).
+function isWhoamiResourceRead(line) {
+  try {
+    const message = JSON.parse(line);
+    return message?.method === "resources/read" && message?.params?.uri === "roamer://whoami";
+  } catch {
+    return false;
+  }
+}
+
+function respondWhoami(line, clientSlug, identityLabel) {
+  let id = null;
+  try {
+    id = JSON.parse(line)?.id ?? null;
+  } catch {
+    // Malformed input never had a usable id anyway — respond with null per JSON-RPC convention.
+  }
+  const payload = { clientSlug: clientSlug ?? null, identityLabel: identityLabel ?? null };
+  const response = {
+    jsonrpc: "2.0",
+    id,
+    result: {
+      contents: [{ uri: "roamer://whoami", mimeType: "application/json", text: JSON.stringify(payload, null, 2) }],
+    },
+  };
+  process.stdout.write(`${JSON.stringify(response)}\n`);
+}
+
 // AUTH-28: a hard sign-in failure (denied/expired device code) must tell the host exactly
 // that, per request, rather than leaving requests unanswered for the host to time out on.
 function respondWithSignInError(line, err) {
@@ -893,6 +965,13 @@ async function main() {
   let ready = false;
   const pendingLines = [];
 
+  // AUTH-60: identityLabel is resolved independently of `ready` (well before transport
+  // connects — see identityResolved below), so roamer://whoami can answer even while the
+  // real upstream connection is still coming up.
+  let identityLabel = null;
+  let identityResolved = false;
+  const pendingWhoamiLines = [];
+
   // AUTH-51: which client is asking, resolved once from the first stdin line (the MCP
   // `initialize` request, always message #1 by protocol) before any credential is touched.
   let clientSlug = null;
@@ -929,6 +1008,12 @@ async function main() {
         clientSlug = clientSlugFromInitializeLine(line);
         resolveFirstLine();
       }
+      // AUTH-60: answered locally from this process's own state, never forwarded upstream.
+      if (isWhoamiResourceRead(line)) {
+        if (identityResolved) respondWhoami(line, clientSlug, identityLabel);
+        else pendingWhoamiLines.push(line);
+        continue;
+      }
       if (ready) {
         forwardLine(transport, line, getTokens, setTokens, freshTokensForForward);
       } else {
@@ -972,18 +1057,23 @@ async function main() {
   freshTokensForForward = (force) => getFreshTokens(clientSlug, force).then((result) => result.tokens);
 
   let reusedSilently = false;
-  let identityLabel = null;
   try {
     const result = await getFreshTokens(clientSlug);
     tokens = result.tokens;
     reusedSilently = result.reusedSilently;
-    identityLabel = result.label;
+    // AUTH-59: live lookup on every run, bounded by fetchLiveLabel's own short timeout — this
+    // adds a network round trip to every ordinary client startup in exchange for a readable
+    // log line; falls back to the existing oid-based label on any failure.
+    identityLabel = (await fetchLiveLabel(result.tokens?.access_token)) ?? result.label;
   } catch (err) {
     // Sign-in genuinely failed (denied/expired), not just slow — every message queued while
     // we waited, starting with `initialize`, gets a real JSON-RPC error so the host sees an
     // explicit failure instead of a process it has to silently time out on.
     log(`Sign-in failed: ${err.message}`);
     for (const line of pendingLines) respondWithSignInError(line, err);
+    // AUTH-60: a whoami read queued during a sign-in that then fails can never get a real
+    // answer — same failure treatment as every other queued line, not left hanging.
+    for (const line of pendingWhoamiLines) respondWithSignInError(line, err);
     process.exit(1);
   }
 
@@ -993,6 +1083,11 @@ async function main() {
   // instant a transient OS notification fired.
   log(identityLabel ? `Authenticated as ${identityLabel} for client "${clientSlug}".` : `Authenticated for client "${clientSlug}" (no identity claim found on the token).`);
 
+  // AUTH-60: identityLabel is now final — answer any roamer://whoami reads that arrived
+  // before sign-in completed, the same way pendingLines get flushed once ready flips true.
+  identityResolved = true;
+  for (const line of pendingWhoamiLines) respondWhoami(line, clientSlug, identityLabel);
+
   // AUTH-51: the moment that used to be completely silent — a process starting up and
   // immediately using a credential it never interactively obtained this run.
   if (reusedSilently) await notifySessionReused(clientSlug, identityLabel);
@@ -1067,7 +1162,8 @@ async function loginCommand(args) {
   const getFreshTokens = isSafari ? getValidTokens : getValidTokensLoopback;
   try {
     const result = await getFreshTokens(clientSlug, false, /* forceFreshLogin */ true);
-    log(`Signed in as ${result.label ?? "(no identity claim found on the token)"} — now the active identity for "${clientSlug}".`);
+    const displayLabel = (await fetchLiveLabel(result.tokens?.access_token)) ?? result.label;
+    log(`Signed in as ${displayLabel ?? "(no identity claim found on the token)"} — now the active identity for "${clientSlug}".`);
   } catch (err) {
     log(`Login failed: ${err.message}`);
     process.exitCode = 1;
@@ -1104,12 +1200,15 @@ async function logoutCommand(args) {
     log(`"${clientSlug}" has no active identity to log out of.`);
     return;
   }
+  // AUTH-59: resolved before deletion, from the very cache file about to be removed.
+  const cachedTokens = await readAnyTokensForIdentity(clientSlug, active.identityKey);
+  const displayLabel = (await fetchLiveLabel(cachedTokens?.access_token)) ?? active.label;
   await Promise.all([
     deleteCacheFile(cacheFilePath("roamer_tokens", clientSlug, active.identityKey)),
     deleteCacheFile(cacheFilePath("roamer_loopback_tokens", clientSlug, active.identityKey)),
   ]);
   await clearActiveIdentity(clientSlug);
-  log(`Logged out ${active.label} for "${clientSlug}". Its next launch will sign in fresh, exactly like a first-ever run.`);
+  log(`Logged out ${displayLabel} for "${clientSlug}". Its next launch will sign in fresh, exactly like a first-ever run.`);
 }
 
 // AUTH-58: --client lists that one slug's cached identities; omitting it surveys every client
@@ -1192,4 +1291,7 @@ export {
   loginCommand,
   logoutCommand,
   statusCommand,
+  // AUTH-60
+  isWhoamiResourceRead,
+  respondWhoami,
 };