@open-webapp/drive-sync 0.5.2 → 0.5.4

package/SPEC.md

@@ -145,6 +145,11 @@ Token acquisition always funnels through `token.ts`'s `acquireToken`, which is c
 Concretely, by module:
 
 - **`token.ts`** is the only place that talks to GIS's `initTokenClient`. It does not know about "wrong account" — it just returns whatever token GIS hands back for the requested `(scopes, prompt, hint)`.
+- **`token.ts`'s `popup_closed` handling** is deliberately two-stage, because GIS reports `popup_closed` for *completed* sign-ins as well as cancelled ones:
+  1. **Grace window** (`POPUP_CLOSED_GRACE_MS`, 2000ms) — wait for a success `callback` that is merely late to still win.
+  2. **Completed-grant probe** (interactive path only) — if no token arrived, issue one `prompt:'none'` request before giving up. A completed consent leaves a live grant at Google, so this resolves with no popup; a cancelled sign-in leaves none, and the original `NeedsReauthError{reason:'popup_closed'}` is rethrown unchanged (never the probe's own error).
+
+  Stage 2 exists because the success `callback` sometimes never arrives *at all* for a completed sign-in, which no grace window can fix. The silent path skips the probe — it is already a `prompt:'none'` request.
 - **`connection.ts`**'s `refreshSilently` is the *only* place that adds wrong-account verification: after `acquireToken({interactive:false, hint:expectedEmail})` resolves, it calls the injected `fetchEmail(token.accessToken)` and compares the result against `expectedEmail`. Mismatch → `clearToken()` then throw `WrongAccountError`; match → return the token.
 - **`http.ts`**'s `driveFetch`/`performFetch` is the 401 path: on a first 401 (not already a retry, not an interactive call), it clears the token and, if a `fetchEmail` was supplied and a connection's email is known, calls `refreshSilently`; otherwise falls back to a bare `acquireToken`. It retries the original request exactly once (`isRetryAfter401` flag) with whatever token comes back. A second 401, or any 401 on an interactive call, throws `NeedsReauthError` without retrying again. A `WrongAccountError` from `refreshSilently` is re-thrown as-is rather than being swallowed into `NeedsReauthError`.
 - **`refresh.ts`**'s `warmUpIfNeeded` is the proactive path: fired from `visibilitychange`→`visible` and `pageshow`(persisted, not hidden) listeners attached by `activate()`. It only acts if a `conn` record exists **and** the cached token is missing or within `REFRESH_BUFFER_MS` (5 minutes) of `expiresAt`. When a `fetchEmail` is configured it goes through `refreshSilently` (so wrong-account detection also covers this path); otherwise it falls back to a bare `acquireToken`. It never *starts* a new attempt while the document is hidden — visibility is checked before it is ever called, so an attempt already in flight from before the tab hid is left to finish on its own.

package/dist/errors.d.ts

@@ -46,6 +46,15 @@ export declare class NotFoundError extends DriveSyncError {
     fileId: string;
     constructor(fileId: string, opts?: DriveSyncErrorOptions);
 }
+/**
+ * Thrown when Drive refuses to serve a file's raw bytes via `alt=media`
+ * because it isn't binary content (e.g. a native Google Docs/Sheets/Slides
+ * file, which only supports Export, not Download).
+ */
+export declare class NotDownloadableError extends DriveSyncError {
+    fileId: string;
+    constructor(fileId: string, opts?: DriveSyncErrorOptions);
+}
 export interface RateLimitedErrorOptions extends DriveSyncErrorOptions {
     retryAfter?: number;
 }

package/dist/errors.js

@@ -59,6 +59,19 @@ export class NotFoundError extends DriveSyncError {
         this.fileId = fileId;
     }
 }
+/**
+ * Thrown when Drive refuses to serve a file's raw bytes via `alt=media`
+ * because it isn't binary content (e.g. a native Google Docs/Sheets/Slides
+ * file, which only supports Export, not Download).
+ */
+export class NotDownloadableError extends DriveSyncError {
+    fileId;
+    constructor(fileId, opts) {
+        super(`File not downloadable as raw content: ${fileId}`, { status: 403, ...opts });
+        this.name = 'NotDownloadableError';
+        this.fileId = fileId;
+    }
+}
 /** Thrown on a 429 response. */
 export class RateLimitedError extends DriveSyncError {
     retryAfter;

package/dist/files.d.ts

@@ -18,7 +18,9 @@ export interface ReadOptions extends BaseCallOptions {
  * since Drive 404s both for a genuinely wrong id and for a file the
  * connected account cannot see — this ambiguity is documented in the public
  * API and callers are expected to treat `null` as "not available" rather
- * than distinguishing the two cases.
+ * than distinguishing the two cases. Also returns `null` for a native Google
+ * Workspace file (Docs/Sheets/Slides/...), since those only support Export,
+ * not the raw `alt=media` download this function issues.
  */
 export declare function read(opts: ReadOptions): Promise<string | Blob | null>;
 export interface RemoveOptions extends BaseCallOptions {

package/dist/files.js

@@ -1,6 +1,6 @@
 import { driveFetch } from './http.js';
 import { escapeQ } from './query.js';
-import { NotFoundError, RemoteChangedError } from './errors.js';
+import { NotFoundError, NotDownloadableError, RemoteChangedError } from './errors.js';
 import { getFileState, setFileState, clearFileState } from './storage.js';
 const DRIVE_BASE = 'https://www.googleapis.com/drive/v3';
 const UPLOAD_BASE = 'https://www.googleapis.com/upload/drive/v3';
@@ -53,7 +53,9 @@ async function recordBaseline(opts, fileId, version) {
  * since Drive 404s both for a genuinely wrong id and for a file the
  * connected account cannot see — this ambiguity is documented in the public
  * API and callers are expected to treat `null` as "not available" rather
- * than distinguishing the two cases.
+ * than distinguishing the two cases. Also returns `null` for a native Google
+ * Workspace file (Docs/Sheets/Slides/...), since those only support Export,
+ * not the raw `alt=media` download this function issues.
  */
 export async function read(opts) {
     try {
@@ -88,7 +90,7 @@ export async function read(opts) {
         return content;
     }
     catch (err) {
-        if (err instanceof NotFoundError) {
+        if (err instanceof NotFoundError || err instanceof NotDownloadableError) {
             return null;
         }
         throw err;

package/dist/http.js

@@ -1,7 +1,7 @@
 import { acquireToken } from './token.js';
 import { getConnection, refreshSilently } from './connection.js';
 import { clearToken, getToken } from './storage.js';
-import { DriveSyncError, NeedsReauthError, ScopeInsufficientError, NotFoundError, RateLimitedError, TransientError, WrongAccountError, } from './errors.js';
+import { DriveSyncError, NeedsReauthError, ScopeInsufficientError, NotFoundError, NotDownloadableError, RateLimitedError, TransientError, WrongAccountError, } from './errors.js';
 const MAX_ATTEMPTS = 3;
 const BASE_DELAY_MS = 500;
 /** Mirrors connection.ts's own buffer: a cached token this close to expiry is treated as unusable. */
@@ -182,6 +182,12 @@ async function performFetch(opts, accessToken, isRetryAfter401) {
                 reason: lastBodyText,
             });
         }
+        if (lastBodyText.includes('fileNotDownloadable')) {
+            // No fileId is reliably available at this layer (see the 404 case
+            // below) — files.ts re-catches this and returns null instead of
+            // rethrowing with the concrete fileId, so the empty default is fine.
+            throw new NotDownloadableError('', { status: 403, reason: lastBodyText });
+        }
         throw new DriveSyncError(`Drive request forbidden (403): ${lastBodyText}`, {
             status: 403,
             reason: lastBodyText,

package/dist/index.js

@@ -227,7 +227,11 @@ export function createDriveSync(options) {
                 });
                 const results = [];
                 for (const p of picked) {
-                    const content = await filesImpl.read({ ...base, fileId: p.fileId, interactive: true });
+                    // Not interactive: the token above was already acquired
+                    // interactively moments ago for the Picker itself and is now
+                    // cached, so each file read reuses it (or silently refreshes)
+                    // instead of forcing its own consent prompt per file.
+                    const content = await filesImpl.read({ ...base, fileId: p.fileId, interactive: false });
                     results.push({ fileId: p.fileId, name: p.name, mimeType: p.mimeType, content });
                 }
                 return results;

package/dist/token.js

@@ -8,6 +8,10 @@ import { createBroadcast } from './broadcast.js';
  * 300ms proved too tight in production: on a real network round-trip the
  * success token can arrive well after GIS's popup-closed poll fires,
  * causing genuinely successful sign-ins to be reported as NeedsReauthError.
+ *
+ * The grace window alone is NOT sufficient: in the field there are completed
+ * sign-ins where the success `callback` never arrives at all, so no window is
+ * long enough. `probeForCompletedGrant` below is what actually recovers those.
  */
 const POPUP_CLOSED_GRACE_MS = 2000;
 /**
@@ -99,26 +103,62 @@ export async function acquireToken(opts) {
         inFlight.delete(key);
     }
 }
-async function acquireTokenUncoalesced(opts) {
-    await waitForGoogleIdentityServices(opts.logger);
-    const w = globalThis;
-    const initTokenClient = w.google?.accounts?.oauth2?.initTokenClient;
-    if (!initTokenClient) {
-        // waitForGoogleIdentityServices resolved, so this should not happen in
-        // practice; guard anyway rather than throwing an obscure TypeError.
-        throw new NeedsReauthError('Google Identity Services is unavailable');
+function isPopupClosedError(err) {
+    return err instanceof NeedsReauthError && err.reason === 'popup_closed';
+}
+/**
+ * Issues ONE `prompt: 'none'` request to find out whether the sign-in that
+ * GIS reported as `popup_closed` actually completed. Resolves with the token
+ * response when a live grant is found; otherwise rethrows `popupClosedError`
+ * — the original interactive failure — so callers see the cancellation they
+ * would have seen before, never a confusing silent-path error.
+ */
+async function probeForCompletedGrant(initTokenClient, opts, popupClosedError) {
+    opts.logger?.debug('drive-sync: popup_closed with no token; probing for a completed grant', {
+        projectId: opts.projectId,
+    });
+    try {
+        // No grace window: `prompt: 'none'` never opens a popup, so there is no
+        // popup-closed poll to race and nothing to wait out on failure.
+        const response = await requestGisToken(initTokenClient, opts, { prompt: 'none', hint: opts.hint }, 0);
+        opts.logger?.debug('drive-sync: recovered a completed sign-in reported as popup_closed', {
+            projectId: opts.projectId,
+        });
+        return response;
     }
-    const response = await new Promise((resolve, reject) => {
-        // These resolve/reject are captured in THIS call's closure only, never
-        // stored on a module-level variable, so a second concurrent call cannot
-        // clobber the first caller's promise.
+    catch (probeError) {
+        opts.logger?.debug('drive-sync: no live grant after popup_closed; treating as cancelled', {
+            projectId: opts.projectId,
+            probeError,
+        });
+        throw popupClosedError;
+    }
+}
+/**
+ * Wraps a single GIS token request in a promise.
+ *
+ * Every call creates a FRESH `initTokenClient`, and the resolve/reject pair is
+ * captured in THIS call's closure only — never on a module-level variable — so
+ * a second concurrent call cannot clobber the first caller's promise.
+ */
+function requestGisToken(initTokenClient, opts, override, popupClosedGraceMs = POPUP_CLOSED_GRACE_MS) {
+    return new Promise((resolve, reject) => {
         let settled = false;
         const client = initTokenClient({
             client_id: opts.clientId,
             scope: opts.scopes.join(' '),
             callback: (res) => {
-                if (settled)
+                if (settled) {
+                    // Diagnostic only: a token arriving after we gave up is the exact
+                    // signature of a grace window that was too short, and is worth
+                    // distinguishing from one that never arrived at all.
+                    opts.logger?.debug('drive-sync: GIS token callback arrived after settle', {
+                        projectId: opts.projectId,
+                        prompt: override.prompt,
+                        hadError: Boolean(res.error),
+                    });
                     return;
+                }
                 settled = true;
                 if (res.error) {
                     reject(new Error(`GIS token request failed: ${res.error}`));
@@ -131,6 +171,13 @@ async function acquireTokenUncoalesced(opts) {
             // the promise below would stay pending forever and every awaiting
             // Drive call would hang until the caller's own timeout (if any).
             error_callback: (err) => {
+                opts.logger?.debug('drive-sync: GIS error_callback', {
+                    projectId: opts.projectId,
+                    prompt: override.prompt,
+                    type: err?.type,
+                    message: err?.message,
+                    settled,
+                });
                 if (settled)
                     return;
                 if (err?.type === 'popup_closed') {
@@ -147,7 +194,7 @@ async function acquireTokenUncoalesced(opts) {
                         reject(new NeedsReauthError('Google sign-in popup was closed before completing', {
                             reason: 'popup_closed',
                         }));
-                    }, POPUP_CLOSED_GRACE_MS);
+                    }, popupClosedGraceMs);
                     return;
                 }
                 settled = true;
@@ -159,17 +206,43 @@ async function acquireTokenUncoalesced(opts) {
         opts.logger?.debug('drive-sync: requesting access token', {
             projectId: opts.projectId,
             interactive: opts.interactive,
+            prompt: override.prompt,
         });
-        client.requestAccessToken({
+        client.requestAccessToken(override);
+    });
+}
+async function acquireTokenUncoalesced(opts) {
+    await waitForGoogleIdentityServices(opts.logger);
+    const w = globalThis;
+    const initTokenClient = w.google?.accounts?.oauth2?.initTokenClient;
+    if (!initTokenClient) {
+        // waitForGoogleIdentityServices resolved, so this should not happen in
+        // practice; guard anyway rather than throwing an obscure TypeError.
+        throw new NeedsReauthError('Google Identity Services is unavailable');
+    }
+    let response;
+    try {
+        response = await requestGisToken(initTokenClient, opts, {
             prompt: opts.interactive ? 'consent' : 'none',
             hint: !opts.interactive ? opts.hint : undefined,
         });
-    }).catch((err) => {
+    }
+    catch (err) {
         if (!opts.interactive) {
             throw new NeedsReauthError('Silent token acquisition failed', { reason: 'gis_error' });
         }
-        throw err;
-    });
+        if (!isPopupClosedError(err)) {
+            throw err;
+        }
+        // GIS said the popup closed and never delivered a token, but that is NOT
+        // proof the user cancelled: a completed consent whose success message is
+        // never posted back to this page looks identical from here. The two cases
+        // ARE distinguishable at Google, though — a completed consent leaves a
+        // live grant behind, so a `prompt: 'none'` request now succeeds with no
+        // popup at all. Probe for it; a cancelled sign-in leaves no grant and the
+        // probe fails, in which case we surface the original popup_closed error.
+        response = await probeForCompletedGrant(initTokenClient, opts, err);
+    }
     const token = await persistTokenResponse(opts.appId, opts.projectId, response);
     // Single choke point for the cross-tab "fresh token available" signal:
     // every acquisition path (interactive connect(), silent refreshSilently(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-webapp/drive-sync",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "type": "module",
   "repository": {
     "type": "git",