@open-webapp/drive-sync 0.5.1 → 0.5.3

package/SPEC.md

@@ -145,6 +145,11 @@ Token acquisition always funnels through `token.ts`'s `acquireToken`, which is c
 Concretely, by module:
 
 - **`token.ts`** is the only place that talks to GIS's `initTokenClient`. It does not know about "wrong account" — it just returns whatever token GIS hands back for the requested `(scopes, prompt, hint)`.
+- **`token.ts`'s `popup_closed` handling** is deliberately two-stage, because GIS reports `popup_closed` for *completed* sign-ins as well as cancelled ones:
+  1. **Grace window** (`POPUP_CLOSED_GRACE_MS`, 2000ms) — wait for a success `callback` that is merely late to still win.
+  2. **Completed-grant probe** (interactive path only) — if no token arrived, issue one `prompt:'none'` request before giving up. A completed consent leaves a live grant at Google, so this resolves with no popup; a cancelled sign-in leaves none, and the original `NeedsReauthError{reason:'popup_closed'}` is rethrown unchanged (never the probe's own error).
+
+  Stage 2 exists because the success `callback` sometimes never arrives *at all* for a completed sign-in, which no grace window can fix. The silent path skips the probe — it is already a `prompt:'none'` request.
 - **`connection.ts`**'s `refreshSilently` is the *only* place that adds wrong-account verification: after `acquireToken({interactive:false, hint:expectedEmail})` resolves, it calls the injected `fetchEmail(token.accessToken)` and compares the result against `expectedEmail`. Mismatch → `clearToken()` then throw `WrongAccountError`; match → return the token.
 - **`http.ts`**'s `driveFetch`/`performFetch` is the 401 path: on a first 401 (not already a retry, not an interactive call), it clears the token and, if a `fetchEmail` was supplied and a connection's email is known, calls `refreshSilently`; otherwise falls back to a bare `acquireToken`. It retries the original request exactly once (`isRetryAfter401` flag) with whatever token comes back. A second 401, or any 401 on an interactive call, throws `NeedsReauthError` without retrying again. A `WrongAccountError` from `refreshSilently` is re-thrown as-is rather than being swallowed into `NeedsReauthError`.
 - **`refresh.ts`**'s `warmUpIfNeeded` is the proactive path: fired from `visibilitychange`→`visible` and `pageshow`(persisted, not hidden) listeners attached by `activate()`. It only acts if a `conn` record exists **and** the cached token is missing or within `REFRESH_BUFFER_MS` (5 minutes) of `expiresAt`. When a `fetchEmail` is configured it goes through `refreshSilently` (so wrong-account detection also covers this path); otherwise it falls back to a bare `acquireToken`. It never *starts* a new attempt while the document is hidden — visibility is checked before it is ever called, so an attempt already in flight from before the tab hid is left to finish on its own.

package/dist/token.js

@@ -5,8 +5,15 @@ import { createBroadcast } from './broadcast.js';
 /**
  * How long to wait, after GIS reports `popup_closed`, for the success
  * `callback` to still win the race before treating it as a real failure.
+ * 300ms proved too tight in production: on a real network round-trip the
+ * success token can arrive well after GIS's popup-closed poll fires,
+ * causing genuinely successful sign-ins to be reported as NeedsReauthError.
+ *
+ * The grace window alone is NOT sufficient: in the field there are completed
+ * sign-ins where the success `callback` never arrives at all, so no window is
+ * long enough. `probeForCompletedGrant` below is what actually recovers those.
  */
-const POPUP_CLOSED_GRACE_MS = 300;
+const POPUP_CLOSED_GRACE_MS = 2000;
 /**
  * Persists a freshly-acquired GIS token response as a StoredToken, deriving
  * expiresAt from the response's own expires_in (never hardcoded) and
@@ -96,26 +103,62 @@ export async function acquireToken(opts) {
         inFlight.delete(key);
     }
 }
-async function acquireTokenUncoalesced(opts) {
-    await waitForGoogleIdentityServices(opts.logger);
-    const w = globalThis;
-    const initTokenClient = w.google?.accounts?.oauth2?.initTokenClient;
-    if (!initTokenClient) {
-        // waitForGoogleIdentityServices resolved, so this should not happen in
-        // practice; guard anyway rather than throwing an obscure TypeError.
-        throw new NeedsReauthError('Google Identity Services is unavailable');
+function isPopupClosedError(err) {
+    return err instanceof NeedsReauthError && err.reason === 'popup_closed';
+}
+/**
+ * Issues ONE `prompt: 'none'` request to find out whether the sign-in that
+ * GIS reported as `popup_closed` actually completed. Resolves with the token
+ * response when a live grant is found; otherwise rethrows `popupClosedError`
+ * — the original interactive failure — so callers see the cancellation they
+ * would have seen before, never a confusing silent-path error.
+ */
+async function probeForCompletedGrant(initTokenClient, opts, popupClosedError) {
+    opts.logger?.debug('drive-sync: popup_closed with no token; probing for a completed grant', {
+        projectId: opts.projectId,
+    });
+    try {
+        // No grace window: `prompt: 'none'` never opens a popup, so there is no
+        // popup-closed poll to race and nothing to wait out on failure.
+        const response = await requestGisToken(initTokenClient, opts, { prompt: 'none', hint: opts.hint }, 0);
+        opts.logger?.debug('drive-sync: recovered a completed sign-in reported as popup_closed', {
+            projectId: opts.projectId,
+        });
+        return response;
     }
-    const response = await new Promise((resolve, reject) => {
-        // These resolve/reject are captured in THIS call's closure only, never
-        // stored on a module-level variable, so a second concurrent call cannot
-        // clobber the first caller's promise.
+    catch (probeError) {
+        opts.logger?.debug('drive-sync: no live grant after popup_closed; treating as cancelled', {
+            projectId: opts.projectId,
+            probeError,
+        });
+        throw popupClosedError;
+    }
+}
+/**
+ * Wraps a single GIS token request in a promise.
+ *
+ * Every call creates a FRESH `initTokenClient`, and the resolve/reject pair is
+ * captured in THIS call's closure only — never on a module-level variable — so
+ * a second concurrent call cannot clobber the first caller's promise.
+ */
+function requestGisToken(initTokenClient, opts, override, popupClosedGraceMs = POPUP_CLOSED_GRACE_MS) {
+    return new Promise((resolve, reject) => {
         let settled = false;
         const client = initTokenClient({
             client_id: opts.clientId,
             scope: opts.scopes.join(' '),
             callback: (res) => {
-                if (settled)
+                if (settled) {
+                    // Diagnostic only: a token arriving after we gave up is the exact
+                    // signature of a grace window that was too short, and is worth
+                    // distinguishing from one that never arrived at all.
+                    opts.logger?.debug('drive-sync: GIS token callback arrived after settle', {
+                        projectId: opts.projectId,
+                        prompt: override.prompt,
+                        hadError: Boolean(res.error),
+                    });
                     return;
+                }
                 settled = true;
                 if (res.error) {
                     reject(new Error(`GIS token request failed: ${res.error}`));
@@ -128,6 +171,13 @@ async function acquireTokenUncoalesced(opts) {
             // the promise below would stay pending forever and every awaiting
             // Drive call would hang until the caller's own timeout (if any).
             error_callback: (err) => {
+                opts.logger?.debug('drive-sync: GIS error_callback', {
+                    projectId: opts.projectId,
+                    prompt: override.prompt,
+                    type: err?.type,
+                    message: err?.message,
+                    settled,
+                });
                 if (settled)
                     return;
                 if (err?.type === 'popup_closed') {
@@ -144,7 +194,7 @@ async function acquireTokenUncoalesced(opts) {
                         reject(new NeedsReauthError('Google sign-in popup was closed before completing', {
                             reason: 'popup_closed',
                         }));
-                    }, POPUP_CLOSED_GRACE_MS);
+                    }, popupClosedGraceMs);
                     return;
                 }
                 settled = true;
@@ -156,17 +206,43 @@ async function acquireTokenUncoalesced(opts) {
         opts.logger?.debug('drive-sync: requesting access token', {
             projectId: opts.projectId,
             interactive: opts.interactive,
+            prompt: override.prompt,
         });
-        client.requestAccessToken({
+        client.requestAccessToken(override);
+    });
+}
+async function acquireTokenUncoalesced(opts) {
+    await waitForGoogleIdentityServices(opts.logger);
+    const w = globalThis;
+    const initTokenClient = w.google?.accounts?.oauth2?.initTokenClient;
+    if (!initTokenClient) {
+        // waitForGoogleIdentityServices resolved, so this should not happen in
+        // practice; guard anyway rather than throwing an obscure TypeError.
+        throw new NeedsReauthError('Google Identity Services is unavailable');
+    }
+    let response;
+    try {
+        response = await requestGisToken(initTokenClient, opts, {
             prompt: opts.interactive ? 'consent' : 'none',
             hint: !opts.interactive ? opts.hint : undefined,
         });
-    }).catch((err) => {
+    }
+    catch (err) {
         if (!opts.interactive) {
             throw new NeedsReauthError('Silent token acquisition failed', { reason: 'gis_error' });
         }
-        throw err;
-    });
+        if (!isPopupClosedError(err)) {
+            throw err;
+        }
+        // GIS said the popup closed and never delivered a token, but that is NOT
+        // proof the user cancelled: a completed consent whose success message is
+        // never posted back to this page looks identical from here. The two cases
+        // ARE distinguishable at Google, though — a completed consent leaves a
+        // live grant behind, so a `prompt: 'none'` request now succeeds with no
+        // popup at all. Probe for it; a cancelled sign-in leaves no grant and the
+        // probe fails, in which case we surface the original popup_closed error.
+        response = await probeForCompletedGrant(initTokenClient, opts, err);
+    }
     const token = await persistTokenResponse(opts.appId, opts.projectId, response);
     // Single choke point for the cross-tab "fresh token available" signal:
     // every acquisition path (interactive connect(), silent refreshSilently(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-webapp/drive-sync",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "type": "module",
   "repository": {
     "type": "git",