@trops/dash-core 0.1.615 → 0.1.617

package/dist/electron/index.js

@@ -9758,6 +9758,17 @@ async function pollForToken$1(deviceCode) {
     s.set("tokenType", data.token_type);
     s.set("authenticatedAt", new Date().toISOString());
 
+    // Persist the Cognito refresh token (+ the client id / region needed to
+    // use it) when the registry forwarded it. This is what lets the app mint
+    // fresh access tokens directly against Cognito on expiry instead of
+    // silently 401-ing every registry call after ~1h. Older registries (or a
+    // browser whose Amplify storage didn't surface the refresh token) omit
+    // these — the app then falls back to re-authenticating on expiry.
+    if (data.refresh_token) s.set("refreshToken", data.refresh_token);
+    if (data.cognito_client_id)
+      s.set("cognitoClientId", data.cognito_client_id);
+    if (data.cognito_region) s.set("cognitoRegion", data.cognito_region);
+
     return {
       status: "authorized",
       token: data.access_token,
@@ -9768,6 +9779,106 @@ async function pollForToken$1(deviceCode) {
   throw new Error(`Unexpected response: ${response.status}`);
 }
 
+/**
+ * Decode a JWT's `exp` claim (no signature verification — we only use it to
+ * decide whether to pre-emptively refresh) and report whether it's expired,
+ * with a 30s skew so we refresh slightly early rather than racing expiry.
+ * Returns false on any parse failure so a malformed token falls through to
+ * the normal request (and the reactive 401 path) rather than forcing churn.
+ */
+function isAccessTokenExpired(token) {
+  try {
+    const seg = token.split(".")[1];
+    const payload = JSON.parse(Buffer.from(seg, "base64").toString("utf8"));
+    if (!payload.exp) return false;
+    return Date.now() >= payload.exp * 1000 - 30000;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Mint a fresh access token from the stored Cognito refresh token via
+ * Cognito's `InitiateAuth` (REFRESH_TOKEN_AUTH). The user-pool client is
+ * public (no secret), so no SECRET_HASH is required. Returns true and updates
+ * the stored access token on success; false if there's no refresh token or
+ * Cognito rejects it (expired/revoked — caller decides whether to sign out).
+ */
+async function refreshAccessToken() {
+  const s = getStore$3();
+  const refreshToken = s.get("refreshToken");
+  const clientId = s.get("cognitoClientId");
+  const region = s.get("cognitoRegion") || "us-east-1";
+  if (!refreshToken || !clientId) return false;
+
+  try {
+    const response = await fetch(
+      `https://cognito-idp.${region}.amazonaws.com/`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-amz-json-1.1",
+          "X-Amz-Target": "AWSCognitoIdentityProviderService.InitiateAuth",
+        },
+        body: JSON.stringify({
+          AuthFlow: "REFRESH_TOKEN_AUTH",
+          ClientId: clientId,
+          AuthParameters: { REFRESH_TOKEN: refreshToken },
+        }),
+      },
+    );
+    if (!response.ok) return false;
+
+    const data = await response.json();
+    const result = data.AuthenticationResult;
+    if (!result || !result.AccessToken) return false;
+
+    s.set("accessToken", result.AccessToken);
+    s.set("authenticatedAt", new Date().toISOString());
+    // REFRESH_TOKEN_AUTH normally does NOT return a new refresh token, but
+    // honor one if rotation is ever enabled.
+    if (result.RefreshToken) s.set("refreshToken", result.RefreshToken);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Authenticated fetch with transparent token refresh.
+ *
+ * - Injects the stored access token as a Bearer header (when present).
+ * - Pre-emptively refreshes when the access token is already expired.
+ * - On a 401, attempts one refresh + retry before giving up.
+ *
+ * Returns a real `Response`. Callers that need to react to a still-401
+ * (refresh failed → truly signed out) check `response.status` and decide
+ * whether to clear credentials. Anonymous callers (no token) just get an
+ * unauthenticated request.
+ */
+async function authedFetch$1(url, options = {}) {
+  let stored = getStoredToken$5();
+
+  if (stored && isAccessTokenExpired(stored.token)) {
+    if (await refreshAccessToken()) stored = getStoredToken$5();
+  }
+
+  const withAuth = (tok) => {
+    const headers = { ...(options.headers || {}) };
+    if (tok) headers.Authorization = `Bearer ${tok}`;
+    return fetch(url, { ...options, headers });
+  };
+
+  let response = await withAuth(stored && stored.token);
+  if (response.status === 401 && stored) {
+    if (await refreshAccessToken()) {
+      const fresh = getStoredToken$5();
+      response = await withAuth(fresh && fresh.token);
+    }
+  }
+  return response;
+}
+
 /**
  * Get the stored auth token.
  *
@@ -9817,14 +9928,11 @@ async function getRegistryProfile$3() {
   if (!stored) return null;
 
   try {
-    const response = await fetch(`${REGISTRY_BASE_URL$2}/api/auth/me`, {
-      headers: {
-        Authorization: `Bearer ${stored.token}`,
-      },
-    });
+    const response = await authedFetch$1(`${REGISTRY_BASE_URL$2}/api/auth/me`);
 
     if (response.status === 401) {
-      // Token expired or invalid — clear stored credentials
+      // Still 401 after authedFetch tried to refresh — the refresh token is
+      // gone/expired too, so the session is genuinely over. Clear it.
       clearToken$2();
       return null;
     }
@@ -9861,10 +9969,9 @@ async function updateRegistryProfile$1(updates) {
   if (!stored) return null;
 
   try {
-    const response = await fetch(`${REGISTRY_BASE_URL$2}/api/auth/me`, {
+    const response = await authedFetch$1(`${REGISTRY_BASE_URL$2}/api/auth/me`, {
       method: "PATCH",
       headers: {
-        Authorization: `Bearer ${stored.token}`,
         "Content-Type": "application/json",
       },
       body: JSON.stringify(updates),
@@ -9893,11 +10000,9 @@ async function getRegistryPackages$1() {
   if (!stored) return null;
 
   try {
-    const response = await fetch(`${REGISTRY_BASE_URL$2}/api/auth/me/packages`, {
-      headers: {
-        Authorization: `Bearer ${stored.token}`,
-      },
-    });
+    const response = await authedFetch$1(
+      `${REGISTRY_BASE_URL$2}/api/auth/me/packages`,
+    );
 
     if (response.status === 401) {
       clearToken$2();
@@ -9924,12 +10029,11 @@ async function updateRegistryPackage$1(scope, name, updates) {
   if (!stored) return null;
 
   try {
-    const response = await fetch(
+    const response = await authedFetch$1(
       `${REGISTRY_BASE_URL$2}/api/packages/${encodeURIComponent(scope)}/${encodeURIComponent(name)}`,
       {
         method: "PATCH",
         headers: {
-          Authorization: `Bearer ${stored.token}`,
           "Content-Type": "application/json",
         },
         body: JSON.stringify(updates),
@@ -9966,13 +10070,10 @@ async function deleteRegistryPackage$1(scope, name) {
   }
 
   try {
-    const response = await fetch(
+    const response = await authedFetch$1(
       `${REGISTRY_BASE_URL$2}/api/packages/${encodeURIComponent(scope)}/${encodeURIComponent(name)}`,
       {
         method: "DELETE",
-        headers: {
-          Authorization: `Bearer ${stored.token}`,
-        },
       },
     );
 
@@ -10035,6 +10136,9 @@ var registryAuthController$2 = {
   updateRegistryPackage: updateRegistryPackage$1,
   deleteRegistryPackage: deleteRegistryPackage$1,
   clearToken: clearToken$2,
+  refreshAccessToken,
+  authedFetch: authedFetch$1,
+  isAccessTokenExpired,
 };
 
 /**
@@ -38834,18 +38938,7 @@ const path$9 = require$$1$2;
 const fs$7 = require$$0$3;
 const os$1 = require$$2;
 const { toPackageId } = packageId;
-const { getStoredToken: getStoredToken$4 } = registryAuthController$2;
-
-/**
- * Build request headers for the registry. When the user is signed in, we
- * include the Bearer token so the server returns private packages that
- * the user owns or has been granted entitlements for. Anonymous fetches
- * still work and simply return only public packages.
- */
-function buildAuthHeaders() {
-  const stored = getStoredToken$4();
-  return stored?.token ? { Authorization: `Bearer ${stored.token}` } : {};
-}
+const { getStoredToken: getStoredToken$4, authedFetch } = registryAuthController$2;
 
 // Default registry API base URL
 const DEFAULT_REGISTRY_API_URL = "https://main.d919rwhuzp7rj.amplifyapp.com";
@@ -38923,9 +39016,7 @@ async function fetchRegistryIndex(forceRefresh = false) {
           "[RegistryController] Fetching registry from:",
           registryUrl,
         );
-        const response = await fetch(registryUrl, {
-          headers: buildAuthHeaders(),
-        });
+        const response = await authedFetch(registryUrl);
         if (!response.ok) {
           throw new Error(
             `Failed to fetch registry: ${response.status} ${response.statusText}`,
@@ -38940,9 +39031,7 @@ async function fetchRegistryIndex(forceRefresh = false) {
         `${process.env.DASH_REGISTRY_API_URL || DEFAULT_REGISTRY_API_URL}/api/packages`;
       console.log("[RegistryController] Fetching registry from:", registryUrl);
 
-      const response = await fetch(registryUrl, {
-        headers: buildAuthHeaders(),
-      });
+      const response = await authedFetch(registryUrl);
       if (!response.ok) {
         throw new Error(
           `Failed to fetch registry: ${response.status} ${response.statusText}`,
@@ -39265,13 +39354,13 @@ async function checkUpdates(installedWidgets = []) {
     ]) {
       const url = `${registryBase}${endpointPath}`;
       try {
-        const response = await fetch(url, {
+        // authedFetch injects the Bearer token and transparently refreshes it
+        // on expiry. Auth is optional here but widens what /resolve returns
+        // for private packages where ownership matters.
+        const response = await authedFetch(url, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
-            // Auth is optional but widens what /resolve returns for
-            // private packages where ownership matters.
-            ...buildAuthHeaders(),
           },
           body: refsBody,
         });
@@ -39441,21 +39530,17 @@ async function fetchPackageSource(packageName, componentName = null) {
     );
   }
 
-  const fetchOpts = {};
   const registryBase =
     process.env.DASH_REGISTRY_API_URL ||
     "https://main.d919rwhuzp7rj.amplifyapp.com";
-  if (
+  // Use authedFetch (Bearer + auto-refresh) only for registry-hosted URLs;
+  // external download URLs (e.g. GitHub releases) must NOT receive our token.
+  const isRegistryUrl =
     pkg.downloadUrl.includes(registryBase) ||
-    pkg.downloadUrl.includes("/api/packages/")
-  ) {
-    const auth = getStoredToken$4();
-    if (auth?.token) {
-      fetchOpts.headers = { Authorization: `Bearer ${auth.token}` };
-    }
-  }
-
-  const response = await fetch(pkg.downloadUrl, fetchOpts);
+    pkg.downloadUrl.includes("/api/packages/");
+  const response = isRegistryUrl
+    ? await authedFetch(pkg.downloadUrl)
+    : await fetch(pkg.downloadUrl);
   if (!response.ok) {
     if (response.status === 401) {
       throw new Error("Authentication required to preview this package");
@@ -39630,21 +39715,17 @@ async function fetchPackageManifest(packageName) {
     );
   }
 
-  const fetchOpts = {};
   const registryBase =
     process.env.DASH_REGISTRY_API_URL ||
     "https://main.d919rwhuzp7rj.amplifyapp.com";
-  if (
+  // Use authedFetch (Bearer + auto-refresh) only for registry-hosted URLs;
+  // external download URLs (e.g. GitHub releases) must NOT receive our token.
+  const isRegistryUrl =
     pkg.downloadUrl.includes(registryBase) ||
-    pkg.downloadUrl.includes("/api/packages/")
-  ) {
-    const auth = getStoredToken$4();
-    if (auth?.token) {
-      fetchOpts.headers = { Authorization: `Bearer ${auth.token}` };
-    }
-  }
-
-  const response = await fetch(pkg.downloadUrl, fetchOpts);
+    pkg.downloadUrl.includes("/api/packages/");
+  const response = isRegistryUrl
+    ? await authedFetch(pkg.downloadUrl)
+    : await fetch(pkg.downloadUrl);
   if (!response.ok) {
     if (response.status === 401) {
       throw new Error("Authentication required to fetch this package manifest");