@open-webapp/drive-sync 0.5.5 → 0.5.6

package/dist/connection.d.ts

@@ -15,8 +15,9 @@ export interface ConnectOptions {
     fetchEmail: (accessToken: string) => Promise<string>;
 }
 /**
- * Interactive connection flow: acquires a token with prompt: 'consent',
- * resolves the account email, and persists the durable Connection record.
+ * Interactive connection flow: acquires a token without forcing a consent
+ * screen, resolves the account email, and persists the durable Connection
+ * record.
  */
 export declare function connect(opts: ConnectOptions): Promise<Connection>;
 export interface RefreshSilentlyOptions {

package/dist/connection.js

@@ -5,8 +5,9 @@ import { WrongAccountError } from './errors.js';
 /** Mirrors refresh.ts's own buffer: a cached token this close to expiry is treated as unusable. */
 const TOKEN_REUSE_BUFFER_MS = 5 * 60 * 1000;
 /**
- * Interactive connection flow: acquires a token with prompt: 'consent',
- * resolves the account email, and persists the durable Connection record.
+ * Interactive connection flow: acquires a token without forcing a consent
+ * screen, resolves the account email, and persists the durable Connection
+ * record.
  */
 export async function connect(opts) {
     // On a re-auth the previous connection's email is the account the user is

package/dist/token.d.ts

@@ -33,9 +33,10 @@ export interface AcquireTokenOptions {
 export declare function notifyExternalTokenRefresh(projectId: string): void;
 /**
  * Single entry point for acquiring a Drive access token, used by BOTH the
- * interactive "connect" path (interactive: true -> prompt: 'consent', no
- * hint) and the silent "refresh" path (interactive: false -> prompt: 'none',
- * hint: the connection's known email).
+ * interactive "connect" path (interactive: true -> prompt: '', i.e. no
+ * forced consent screen) and the silent "refresh" path (interactive: false
+ * -> prompt: 'none'). Both pass `hint`: the connection's known email, when
+ * there is one.
  *
  * Design contract (see report): if `interactive` is false and GIS reports an
  * error on the silent attempt, this function throws a NeedsReauthError

package/dist/token.js

@@ -71,9 +71,10 @@ export function notifyExternalTokenRefresh(projectId) {
 }
 /**
  * Single entry point for acquiring a Drive access token, used by BOTH the
- * interactive "connect" path (interactive: true -> prompt: 'consent', no
- * hint) and the silent "refresh" path (interactive: false -> prompt: 'none',
- * hint: the connection's known email).
+ * interactive "connect" path (interactive: true -> prompt: '', i.e. no
+ * forced consent screen) and the silent "refresh" path (interactive: false
+ * -> prompt: 'none'). Both pass `hint`: the connection's known email, when
+ * there is one.
  *
  * Design contract (see report): if `interactive` is false and GIS reports an
  * error on the silent attempt, this function throws a NeedsReauthError
@@ -248,8 +249,19 @@ async function acquireTokenUncoalesced(opts) {
     let response;
     try {
         response = await requestGisToken(initTokenClient, opts, {
-            prompt: opts.interactive ? 'consent' : 'none',
-            hint: !opts.interactive ? opts.hint : undefined,
+            // The interactive path deliberately does NOT force `prompt: 'consent'`.
+            // Forcing the full consent screen on every connect buys nothing in the
+            // implicit (token) flow — there is no refresh token to obtain — while
+            // holding a popup open for seconds. That popup lifetime IS the window
+            // in which GIS's popup-closed poll beats delivery of the token, so
+            // forcing consent manufactures the very race the probe below recovers
+            // from. `prompt: ''` lets Google skip straight through when the grant
+            // already exists (and still shows consent on the first grant, or when
+            // new scopes are requested), which closes the race instead of racing
+            // it. The hint goes on both paths so an already-known account can skip
+            // the chooser too.
+            prompt: opts.interactive ? '' : 'none',
+            hint: opts.hint,
         });
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-webapp/drive-sync",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "repository": {
     "type": "git",