@mintlify/cli 4.0.1098 → 4.0.1099

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintlify/cli",
-  "version": "4.0.1098",
+  "version": "4.0.1099",
   "description": "The Mintlify CLI",
   "engines": {
     "node": ">=18.0.0"
@@ -93,5 +93,5 @@
     "vitest": "2.1.9",
     "vitest-mock-process": "1.0.4"
   },
-  "gitHead": "edd192ddf9723fff5a7d818a9e6937e17b8806a1"
+  "gitHead": "9580be43b49210b3a2a21e11e8b6930f67801556"
 }

package/src/analytics/client.ts

@@ -1,3 +1,4 @@
+import { authenticatedFetch } from '../authenticatedFetch.js';
 import { API_URL } from '../constants.js';
 import type {
   BucketThreadsResponse,
@@ -13,32 +14,14 @@ import type {
 
 type Params = Record<string, string | number | undefined>;
 
-async function getAuthHeaders(): Promise<Record<string, string>> {
-  try {
-    const { getAccessToken } = await import('../keyring.js');
-    const token = await getAccessToken();
-    if (token) {
-      return { Authorization: `Bearer ${token}` };
-    }
-  } catch {}
-
-  const envToken = process.env.MINTLIFY_SESSION_TOKEN;
-  if (envToken) {
-    return { Authorization: `Bearer ${envToken}` };
-  }
-
-  throw new Error('Not authenticated. Run `mint login` to authenticate.');
-}
-
 async function request<T>(path: string, params: Params = {}): Promise<T> {
   const url = new URL(`${API_URL}/api/cli/analytics${path}`);
   for (const [key, value] of Object.entries(params)) {
     if (value !== undefined) url.searchParams.set(key, String(value));
   }
 
-  const authHeaders = await getAuthHeaders();
-  const res = await fetch(url, {
-    headers: { ...authHeaders, Accept: 'application/json' },
+  const res = await authenticatedFetch(url.toString(), {
+    headers: { Accept: 'application/json' },
   });
 
   if (!res.ok) {

package/src/authenticatedFetch.ts

@@ -0,0 +1,42 @@
+import { getAccessToken } from './keyring.js';
+import { refreshAccessToken } from './tokenRefresh.js';
+
+async function getKeyringToken(): Promise<string | null> {
+  try {
+    return await getAccessToken();
+  } catch {
+    return null;
+  }
+}
+
+export async function authenticatedFetch(url: string | URL, init?: RequestInit): Promise<Response> {
+  const keyringToken = await getKeyringToken();
+  const envToken = process.env.MINTLIFY_SESSION_TOKEN;
+  const token = keyringToken ?? envToken;
+
+  if (!token) {
+    throw new Error('Not authenticated. Run `mint login` to authenticate.');
+  }
+
+  const makeRequest = (t: string) =>
+    fetch(url, {
+      ...init,
+      headers: { ...init?.headers, Authorization: `Bearer ${t}` },
+    });
+
+  const res = await makeRequest(token);
+  if (res.status !== 401) return res;
+
+  // If the keyring token expired, try refreshing it
+  if (keyringToken) {
+    const refreshed = await refreshAccessToken();
+    if (refreshed) return makeRequest(refreshed);
+  }
+
+  // Fall back to the env session token if it wasn't already used
+  if (envToken && token !== envToken) {
+    return makeRequest(envToken);
+  }
+
+  return res;
+}

package/src/keyring.ts

@@ -27,6 +27,11 @@ export async function getAccessToken(): Promise<string | null> {
   return keytar.getPassword(SERVICE, ACCESS_TOKEN_ACCOUNT);
 }
 
+export async function getRefreshToken(): Promise<string | null> {
+  const keytar = await getKeytar();
+  return keytar.getPassword(SERVICE, REFRESH_TOKEN_ACCOUNT);
+}
+
 export async function clearCredentials(): Promise<void> {
   const keytar = await getKeytar();
   await Promise.all([

package/src/status.tsx

@@ -2,6 +2,7 @@ import { addLog, ErrorLog } from '@mintlify/previewing';
 import { Box, Text } from 'ink';
 import { z } from 'zod';
 
+import { authenticatedFetch } from './authenticatedFetch.js';
 import { getConfigValue } from './config.js';
 import { API_URL } from './constants.js';
 import { getCliVersion } from './helpers.js';
@@ -36,9 +37,7 @@ export async function status(): Promise<void> {
   }
 
   try {
-    const res = await fetch(`${API_URL}/api/cli/status`, {
-      headers: { Authorization: `Bearer ${accessToken}` },
-    });
+    const res = await authenticatedFetch(`${API_URL}/api/cli/status`);
 
     if (!res.ok) {
       addLog(<ErrorLog message="not logged in. Run `mint login` to authenticate." />);

package/src/tokenRefresh.ts

@@ -0,0 +1,48 @@
+import { STYTCH_CLIENT_ID, TOKEN_ENDPOINT } from './constants.js';
+import { getRefreshToken, storeCredentials } from './keyring.js';
+
+interface TokenResponse {
+  access_token: string;
+  refresh_token: string;
+  token_type: 'bearer';
+  expires_in: number;
+}
+
+let inflightRefresh: Promise<string | null> | null = null;
+
+export async function refreshAccessToken(): Promise<string | null> {
+  if (inflightRefresh) return inflightRefresh;
+
+  inflightRefresh = doRefresh().finally(() => {
+    inflightRefresh = null;
+  });
+
+  return inflightRefresh;
+}
+
+async function doRefresh(): Promise<string | null> {
+  try {
+    const refreshToken = await getRefreshToken();
+    if (!refreshToken) return null;
+
+    const res = await fetch(TOKEN_ENDPOINT, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        client_id: STYTCH_CLIENT_ID,
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+      }),
+    });
+
+    if (!res.ok) return null;
+
+    const body = (await res.json().catch(() => null)) as TokenResponse | null;
+    if (!body?.access_token || !body.refresh_token) return null;
+
+    await storeCredentials(body.access_token, body.refresh_token);
+    return body.access_token;
+  } catch {
+    return null;
+  }
+}