@notis_ai/cli 0.2.0-beta.92.1 → 0.2.0-beta.99.1

package/src/runtime/transport.js

@@ -3,11 +3,11 @@ import { createReadStream } from 'node:fs';
 import { CliError, EXIT_CODES } from './errors.js';
 import {
   DEFAULT_PROFILE,
-  ensureProfile,
   getProfile,
+  isJwtExpired,
   loadConfig,
-  saveConfig,
 } from './profiles.js';
+import { createExpiredAuthError, createInvalidAuthHints } from './desktop-auth.js';
 
 function escapeMultipartHeaderValue(value) {
   return String(value ?? '')
@@ -76,7 +76,7 @@ function createMultipartFileUpload(payload, bindingMetadata, fileBindings) {
   };
 }
 
-function normalizeBackendError(status, payload) {
+function normalizeBackendError(status, payload, runtime) {
   const backendError = payload?.error;
   const message =
     backendError?.message ||
@@ -91,10 +91,7 @@ function normalizeBackendError(status, payload) {
       message,
       exitCode: EXIT_CODES.auth,
       hints: [
-        {
-          command: 'Open the Notis desktop app and sign in',
-          reason: 'Open the Notis desktop app to refresh CLI auth, or set NOTIS_JWT',
-        },
+        ...createInvalidAuthHints(runtime),
       ],
       details: payload || {},
     });
@@ -145,46 +142,10 @@ function normalizeBackendError(status, payload) {
   });
 }
 
-function shouldAttemptDevPortalRefresh(runtime, { force = false } = {}) {
-  if (runtime.authMode !== 'dev_portal' || !runtime.refreshToken || !runtime.apiBase) {
-    return false;
-  }
-
-  if (force) {
-    return true;
-  }
-
-  if (typeof runtime.accessExpiresAt !== 'number' || runtime.accessExpiresAt <= 0) {
+function reloadJwtFromConfig(runtime) {
+  if (runtime.credentialSource === 'env') {
     return false;
   }
-
-  const thresholdSeconds = 60;
-  return runtime.accessExpiresAt - Math.floor(Date.now() / 1000) <= thresholdSeconds;
-}
-
-function persistDevPortalRuntimeAuth(runtime, session) {
-  const config = ensureProfile(loadConfig(), runtime.profileName || DEFAULT_PROFILE);
-  const profileName = runtime.profileName || DEFAULT_PROFILE;
-  config.current_profile = profileName;
-  config.profiles[profileName] = {
-    ...config.profiles[profileName],
-    jwt: session.access_token,
-    api_base: runtime.apiBase,
-    auth_mode: 'dev_portal',
-    refresh_token: session.refresh_token,
-    access_expires_at: session.access_expires_at,
-    refresh_expires_at: session.refresh_expires_at,
-  };
-  saveConfig(config);
-
-  runtime.jwt = session.access_token;
-  runtime.authMode = 'dev_portal';
-  runtime.refreshToken = session.refresh_token;
-  runtime.accessExpiresAt = session.access_expires_at;
-  runtime.refreshExpiresAt = session.refresh_expires_at;
-}
-
-function reloadJwtFromConfig(runtime) {
   const profileName = runtime.profileName || DEFAULT_PROFILE;
   let profile;
   try {
@@ -197,39 +158,8 @@ function reloadJwtFromConfig(runtime) {
     return false;
   }
   runtime.jwt = nextJwt;
-  runtime.authMode = profile.auth_mode;
-  runtime.refreshToken = profile.refresh_token;
-  runtime.accessExpiresAt = profile.access_expires_at;
-  runtime.refreshExpiresAt = profile.refresh_expires_at;
-  return true;
-}
-
-async function maybeRefreshDevPortalAuth(runtime, { force = false } = {}) {
-  if (!shouldAttemptDevPortalRefresh(runtime, { force })) {
-    return false;
-  }
-
-  const response = await fetch(`${runtime.apiBase}/portal_auth/dev-refresh`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'X-Notis-CLI-Version': runtime.cliVersion,
-    },
-    body: JSON.stringify({ refresh_token: runtime.refreshToken }),
-  });
-
-  let payload = null;
-  try {
-    payload = await response.json();
-  } catch {
-    payload = null;
-  }
-
-  if (!response.ok || !payload?.session?.access_token || !payload?.session?.refresh_token) {
-    throw normalizeBackendError(response.status, payload);
-  }
-
-  persistDevPortalRuntimeAuth(runtime, payload.session);
+  runtime.desktopAppName = profile.desktop_app_name;
+  runtime.desktopPid = profile.desktop_pid;
   return true;
 }
 
@@ -241,7 +171,14 @@ export async function httpRequest({
   multipart = false,
   requireAuth = true,
 }) {
-  await maybeRefreshDevPortalAuth(runtime);
+  // The desktop renderer is the single owner of the rotating Supabase refresh
+  // token. Each CLI request only consumes the newest access token it synced to
+  // disk, avoiding refresh-token races between independent CLI processes and
+  // the running desktop session.
+  reloadJwtFromConfig(runtime);
+  if (requireAuth && isJwtExpired(runtime.jwt)) {
+    throw createExpiredAuthError(runtime);
+  }
 
   let controller = new AbortController();
   let timeout = setTimeout(() => controller.abort(), runtime.timeoutMs);
@@ -298,8 +235,7 @@ export async function httpRequest({
     }
 
     if (response.status === 401) {
-      const refreshed = (await maybeRefreshDevPortalAuth(runtime, { force: true }))
-        || reloadJwtFromConfig(runtime);
+      const refreshed = reloadJwtFromConfig(runtime) && !isJwtExpired(runtime.jwt);
       if (refreshed) {
         if (requireAuth && runtime.jwt) {
           headers.Authorization = `Bearer ${runtime.jwt}`;
@@ -324,7 +260,10 @@ export async function httpRequest({
     clearTimeout(timeout);
 
     if (!response.ok) {
-      throw normalizeBackendError(response.status, payload);
+      if (response.status === 401 && isJwtExpired(runtime.jwt)) {
+        throw createExpiredAuthError(runtime);
+      }
+      throw normalizeBackendError(response.status, payload, runtime);
     }
 
     return {