@unifiedmemory/cli 1.3.13 → 1.3.14

package/lib/token-storage.js

@@ -14,12 +14,6 @@ export function saveToken(tokenData) {
   // Ensure directory permissions are correct (in case it was created with wrong permissions)
   fs.chmodSync(TOKEN_DIR, 0o700);
 
-  // Preserve existing organization context if not explicitly overwritten
-  const existingData = getToken();
-  if (existingData && existingData.selectedOrg && !tokenData.selectedOrg) {
-    tokenData.selectedOrg = existingData.selectedOrg;
-  }
-
   // Write token file with owner-only read/write permissions (0600)
   fs.writeFileSync(TOKEN_FILE, JSON.stringify(tokenData, null, 2));
   // Explicitly set file permissions (writeFileSync mode option doesn't always work with extended attributes)
@@ -46,31 +40,43 @@ export function clearToken() {
 }
 
 /**
- * Update the selected organization context
- * @param {Object|null} orgData - Organization data or null for personal context
+ * Get organization context from JWT claims
+ * JWT is the single source of truth for org context
+ * @returns {Object|null} Organization context or null if personal context
  */
-export function updateSelectedOrg(orgData) {
-  const tokenData = getToken();
-  if (!tokenData) {
-    throw new Error('No token found. Please login first.');
+export function getOrgContext() {
+  const token = getToken();
+
+  // Try nested 'o' object first (original OAuth token format)
+  if (token?.decoded?.o?.o_id) {
+    return {
+      id: token.decoded.o.o_id,
+      name: token.decoded.o.o_name,
+      slug: token.decoded.o.o_slug,
+      role: token.decoded.o.o_role
+    };
   }
 
-  // Ensure directory permissions are correct
-  if (fs.existsSync(TOKEN_DIR)) {
-    fs.chmodSync(TOKEN_DIR, 0o700);
+  // Fall back to flat org_* claims (org-scoped token from Clerk)
+  if (token?.decoded?.org_id) {
+    return {
+      id: token.decoded.org_id,
+      name: token.decoded.org_name,
+      slug: token.decoded.org_slug,
+      role: token.decoded.org_role
+    };
   }
 
-  tokenData.selectedOrg = orgData;
-  // Write with owner-only read/write permissions (0600)
-  fs.writeFileSync(TOKEN_FILE, JSON.stringify(tokenData, null, 2));
-  fs.chmodSync(TOKEN_FILE, 0o600);
-}
+  // Fall back to selectedOrgId from login state parameter
+  // This is used when JWT doesn't have org claims (Clerk setActive limitation)
+  if (token?.selectedOrgId) {
+    return {
+      id: token.selectedOrgId,
+      name: token.selectedOrgName || null,
+      slug: null,
+      role: null
+    };
+  }
 
-/**
- * Get the currently selected organization context
- * @returns {Object|null} Organization data or null if personal context
- */
-export function getSelectedOrg() {
-  const tokenData = getToken();
-  return tokenData?.selectedOrg || null;
+  return null;
 }

package/lib/token-validation.js

@@ -1,11 +1,9 @@
-import { getToken, saveToken } from './token-storage.js';
+import { getToken } from './token-storage.js';
 import { isTokenExpired, refreshAccessToken } from './token-refresh.js';
-import { getOrgScopedToken } from './clerk-api.js';
-import { parseJWT } from './jwt-utils.js';
-import { config } from './config.js';
 
 /**
  * Load token and refresh if expired
+ * JWT is the single source of truth - no recovery logic needed
  * @param {boolean} requireAuth - Whether to throw if not authenticated (default true)
  * @returns {Promise<Object|null>} - Token data or null
  * @throws {Error} - If not authenticated and requireAuth is true, or if refresh fails
@@ -46,86 +44,5 @@ export async function loadAndRefreshToken(requireAuth = true) {
     }
   }
 
-  // Check if token has org context but lacks org claims in JWT
-  // This can happen if getOrgScopedToken() failed during login
-  if (tokenData.selectedOrg?.id && !tokenData.decoded?.o) {
-    console.error('⚠️  Token missing org claims, attempting to fix...');
-
-    // Check for sid in decoded token or preserved originalSid from login
-    let sessionId = tokenData.decoded?.sid || tokenData.originalSid;
-    let currentToken = tokenData.idToken || tokenData.accessToken;
-
-    // If no sid, try to refresh first to get a new base token with sid
-    if (!sessionId && tokenData.refresh_token) {
-      console.error('  Refreshing to obtain session ID...');
-      try {
-        const tokenParams = {
-          client_id: config.clerkClientId,
-          refresh_token: tokenData.refresh_token,
-          grant_type: 'refresh_token',
-        };
-
-        if (config.clerkClientSecret) {
-          tokenParams.client_secret = config.clerkClientSecret;
-        }
-
-        const response = await fetch(`https://${config.clerkDomain}/oauth/token`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          body: new URLSearchParams(tokenParams),
-        });
-
-        if (response.ok) {
-          const newTokenData = await response.json();
-          const refreshedToken = newTokenData.id_token || newTokenData.access_token;
-          const refreshedDecoded = parseJWT(refreshedToken);
-
-          sessionId = refreshedDecoded?.sid;
-          currentToken = refreshedToken;
-
-          // Update tokenData with refreshed values
-          tokenData.accessToken = newTokenData.access_token;
-          tokenData.idToken = newTokenData.id_token;
-          tokenData.refresh_token = newTokenData.refresh_token || tokenData.refresh_token;
-          tokenData.decoded = refreshedDecoded;
-
-          if (sessionId) {
-            console.error('  ✓ Obtained session ID');
-          }
-        }
-      } catch (error) {
-        console.error(`  Could not refresh token: ${error.message}`);
-      }
-    }
-
-    // Now try to get org-scoped token if we have sessionId
-    if (sessionId) {
-      try {
-        const orgToken = await getOrgScopedToken(
-          sessionId,
-          tokenData.selectedOrg.id,
-          currentToken
-        );
-
-        const decoded = parseJWT(orgToken.jwt);
-        const updatedToken = {
-          ...tokenData,
-          idToken: orgToken.jwt,
-          decoded: decoded,
-        };
-
-        saveToken(updatedToken);
-        console.error('✓ Token updated with org claims');
-        return updatedToken;
-      } catch (error) {
-        console.error(`⚠️  Could not get org-scoped token: ${error.message}`);
-        // Continue with existing token - API calls may fail
-      }
-    } else {
-      console.error('⚠️  Could not obtain session ID for org-scoped token');
-      console.error('   Please run: um login');
-    }
-  }
-
   return tokenData;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unifiedmemory/cli",
-  "version": "1.3.13",
+  "version": "1.3.14",
   "description": "UnifiedMemory CLI - AI code assistant integration",
   "main": "index.js",
   "type": "module",

package/tests/unit/mcp-proxy.test.js

@@ -221,7 +221,7 @@ describe('mcp-proxy', () => {
 
       const authContext = {
         decoded: { sub: 'user_123' },
-        selectedOrg: { id: 'org_456' },
+        orgContext: { id: 'org_456' },
       };
 
       const projectContext = {
@@ -245,7 +245,7 @@ describe('mcp-proxy', () => {
       expect(capturedBody.params.arguments.headers['X-Org-Id']).toBe('org_456');
     });
 
-    it('should fallback to user_id for org when no selectedOrg', async () => {
+    it('should not inject org when no orgContext (personal context)', async () => {
       let capturedBody = null;
 
       server.use(
@@ -263,7 +263,7 @@ describe('mcp-proxy', () => {
 
       const authContext = {
         decoded: { sub: 'user_123' },
-        // No selectedOrg
+        // No orgContext - personal context
       };
 
       await callRemoteMCPTool(
@@ -274,9 +274,12 @@ describe('mcp-proxy', () => {
         null
       );
 
-      // Org should fallback to user_id
-      expect(capturedBody.params.arguments.pathParams.org).toBe('user_123');
-      expect(capturedBody.params.arguments.headers['X-Org-Id']).toBe('user_123');
+      // No org injection for personal context - gateway handles this
+      expect(capturedBody.params.arguments.pathParams.org).toBeUndefined();
+      expect(capturedBody.params.arguments.headers['X-Org-Id']).toBeUndefined();
+      // User should still be injected
+      expect(capturedBody.params.arguments.pathParams.user).toBe('user_123');
+      expect(capturedBody.params.arguments.headers['X-User-Id']).toBe('user_123');
     });
 
     it('should return tool execution result', async () => {

package/tests/unit/token-refresh.test.js

@@ -44,17 +44,9 @@ vi.mock('../../lib/jwt-utils.js', () => ({
   }),
 }));
 
-vi.mock('../../lib/clerk-api.js', () => ({
-  getOrgScopedToken: vi.fn().mockResolvedValue({
-    jwt: 'org_scoped_jwt',
-    object: 'token',
-  }),
-}));
-
 // Import after mocking
 import { isTokenExpired, refreshAccessToken } from '../../lib/token-refresh.js';
 import { saveToken } from '../../lib/token-storage.js';
-import { getOrgScopedToken } from '../../lib/clerk-api.js';
 
 describe('isTokenExpired', () => {
   it('returns true for null tokenData', () => {
@@ -181,7 +173,7 @@ describe('refreshAccessToken', () => {
     );
   });
 
-  it('preserves selectedOrg in refreshed token', async () => {
+  it('preserves selectedOrgId and selectedOrgName in refreshed token', async () => {
     global.fetch = vi.fn().mockResolvedValue({
       ok: true,
       json: () => Promise.resolve({
@@ -193,60 +185,42 @@ describe('refreshAccessToken', () => {
       }),
     });
 
-    const selectedOrg = { id: 'org_456', name: 'Test Org', role: 'admin' };
-    await refreshAccessToken({ refresh_token: 'rt_123', selectedOrg });
+    await refreshAccessToken({
+      refresh_token: 'rt_123',
+      selectedOrgId: 'org_456',
+      selectedOrgName: 'Test Org',
+    });
 
     expect(saveToken).toHaveBeenCalledWith(
       expect.objectContaining({
-        selectedOrg: selectedOrg,
+        selectedOrgId: 'org_456',
+        selectedOrgName: 'Test Org',
       })
     );
   });
 
-  it('gets org-scoped token when selectedOrg exists and refreshed token has sid', async () => {
+  it('preserves sessionId through refresh', async () => {
     global.fetch = vi.fn().mockResolvedValue({
       ok: true,
       json: () => Promise.resolve({
         access_token: 'new_access_token',
-        id_token: 'new_id_token_with_sid',
+        id_token: 'new_id_token',
         refresh_token: 'new_refresh_token',
         token_type: 'Bearer',
         expires_in: 3600,
       }),
     });
 
-    const selectedOrg = { id: 'org_456', name: 'Test Org', role: 'admin' };
-    await refreshAccessToken({ refresh_token: 'rt_123', selectedOrg });
-
-    expect(getOrgScopedToken).toHaveBeenCalledWith(
-      'sess_new_123',
-      'org_456',
-      'new_id_token_with_sid'
-    );
-  });
-
-  it('continues with base token when getOrgScopedToken fails', async () => {
-    global.fetch = vi.fn().mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({
-        access_token: 'new_access_token',
-        id_token: 'new_id_token_with_sid',
-        refresh_token: 'new_refresh_token',
-        token_type: 'Bearer',
-        expires_in: 3600,
-      }),
+    await refreshAccessToken({
+      refresh_token: 'rt_123',
+      sessionId: 'sess_123',
     });
 
-    // Make getOrgScopedToken fail
-    vi.mocked(getOrgScopedToken).mockRejectedValueOnce(new Error('API error'));
-
-    const selectedOrg = { id: 'org_456', name: 'Test Org', role: 'admin' };
-
-    // Should not throw - continues with base token
-    const result = await refreshAccessToken({ refresh_token: 'rt_123', selectedOrg });
-
-    expect(result).toBeDefined();
-    expect(result.idToken).toBe('new_id_token_with_sid'); // Falls back to base token
+    expect(saveToken).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sessionId: 'sess_123',
+      })
+    );
   });
 
   it('throws error when OAuth refresh fails with 400', async () => {

package/tests/unit/token-storage.test.js

@@ -132,7 +132,6 @@ describe('token-storage module behavior', () => {
     expect(typeof ts.saveToken).toBe('function');
     expect(typeof ts.getToken).toBe('function');
     expect(typeof ts.clearToken).toBe('function');
-    expect(typeof ts.updateSelectedOrg).toBe('function');
-    expect(typeof ts.getSelectedOrg).toBe('function');
+    expect(typeof ts.getOrgContext).toBe('function');
   });
 });

package/tests/unit/token-validation.test.js

@@ -1,15 +1,15 @@
 /**
  * Unit tests for lib/token-validation.js
  *
- * Tests token loading, expiration checking, and org claims recovery.
+ * Tests token loading and expiration checking.
+ * The implementation is simple: load token, refresh if expired.
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
-// Mock dependencies - using factory functions to avoid hoisting issues
+// Mock dependencies
 vi.mock('../../lib/token-storage.js', () => ({
   getToken: vi.fn(),
-  saveToken: vi.fn(),
 }));
 
 vi.mock('../../lib/token-refresh.js', () => ({
@@ -17,28 +17,10 @@ vi.mock('../../lib/token-refresh.js', () => ({
   refreshAccessToken: vi.fn(),
 }));
 
-vi.mock('../../lib/clerk-api.js', () => ({
-  getOrgScopedToken: vi.fn(),
-}));
-
-vi.mock('../../lib/jwt-utils.js', () => ({
-  parseJWT: vi.fn(),
-}));
-
-vi.mock('../../lib/config.js', () => ({
-  config: {
-    clerkDomain: 'clerk.test.com',
-    clerkClientId: 'test_client_id',
-    clerkClientSecret: 'test_client_secret',
-  },
-}));
-
 // Import after mocking
 import { loadAndRefreshToken } from '../../lib/token-validation.js';
-import { getToken, saveToken } from '../../lib/token-storage.js';
+import { getToken } from '../../lib/token-storage.js';
 import { isTokenExpired, refreshAccessToken } from '../../lib/token-refresh.js';
-import { getOrgScopedToken } from '../../lib/clerk-api.js';
-import { parseJWT } from '../../lib/jwt-utils.js';
 
 describe('loadAndRefreshToken', () => {
   const futureExp = Math.floor(Date.now() / 1000) + 3600;
@@ -130,238 +112,39 @@ describe('loadAndRefreshToken', () => {
     });
   });
 
-  describe('org claims recovery', () => {
-    it('recovers using decoded.sid when org claims missing', async () => {
-      const tokenMissingOrgClaims = {
-        idToken: 'token_no_org',
-        decoded: { exp: futureExp, sid: 'sess_123' },
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-      };
-
-      vi.mocked(getToken).mockReturnValue(tokenMissingOrgClaims);
-      vi.mocked(getOrgScopedToken).mockResolvedValue({
-        jwt: 'org_scoped_jwt',
-      });
-      vi.mocked(parseJWT).mockReturnValue({
-        exp: futureExp,
-        o: { o_id: 'org_456' },
-      });
-
-      await loadAndRefreshToken();
-
-      expect(getOrgScopedToken).toHaveBeenCalledWith(
-        'sess_123',
-        'org_456',
-        'token_no_org'
-      );
-      expect(saveToken).toHaveBeenCalled();
-    });
-
-    it('recovers using originalSid when decoded.sid is missing', async () => {
-      const tokenWithOriginalSid = {
-        idToken: 'token_org_scoped',
-        decoded: { exp: futureExp }, // No sid - org-scoped token
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-        originalSid: 'sess_original',
-      };
-
-      vi.mocked(getToken).mockReturnValue(tokenWithOriginalSid);
-      vi.mocked(getOrgScopedToken).mockResolvedValue({
-        jwt: 'new_org_scoped_jwt',
-      });
-      vi.mocked(parseJWT).mockReturnValue({
-        exp: futureExp,
-        o: { o_id: 'org_456' },
-      });
-
-      await loadAndRefreshToken();
-
-      expect(getOrgScopedToken).toHaveBeenCalledWith(
-        'sess_original',
-        'org_456',
-        'token_org_scoped'
-      );
-    });
-
-    it('skips recovery when token already has org claims', async () => {
-      const tokenWithOrgClaims = {
-        idToken: 'complete_token',
-        decoded: { exp: futureExp, o: { o_id: 'org_456' } },
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-      };
-
-      vi.mocked(getToken).mockReturnValue(tokenWithOrgClaims);
-
-      const result = await loadAndRefreshToken();
-
-      expect(getOrgScopedToken).not.toHaveBeenCalled();
-      expect(result.decoded.o).toBeDefined();
-    });
-
-    it('skips recovery when no selectedOrg (personal account)', async () => {
-      const personalToken = {
-        idToken: 'personal_token',
-        decoded: { exp: futureExp, sid: 'sess_123' },
-        // No selectedOrg - personal account
-      };
-
-      vi.mocked(getToken).mockReturnValue(personalToken);
-
-      await loadAndRefreshToken();
-
-      expect(getOrgScopedToken).not.toHaveBeenCalled();
-    });
-
-    it('skips recovery when selectedOrg has no id', async () => {
-      const tokenWithEmptyOrg = {
-        idToken: 'token_empty_org',
-        decoded: { exp: futureExp, sid: 'sess_123' },
-        selectedOrg: {}, // Empty org object
-      };
-
-      vi.mocked(getToken).mockReturnValue(tokenWithEmptyOrg);
-
-      await loadAndRefreshToken();
-
-      expect(getOrgScopedToken).not.toHaveBeenCalled();
-    });
-
-    it('continues gracefully when recovery fails', async () => {
-      const brokenToken = {
-        idToken: 'broken_token',
-        decoded: { exp: futureExp, sid: 'sess_123' },
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-      };
-
-      vi.mocked(getToken).mockReturnValue(brokenToken);
-      vi.mocked(getOrgScopedToken).mockRejectedValue(new Error('API error'));
-
-      // Should not throw, just log warning and return token
-      const result = await loadAndRefreshToken();
-
-      expect(result).toBeDefined();
-      expect(result.idToken).toBe('broken_token');
-    });
-
-    it('saves updated token after successful recovery', async () => {
-      const tokenMissingOrgClaims = {
-        idToken: 'token_no_org',
-        decoded: { exp: futureExp, sid: 'sess_123' },
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-        refresh_token: 'rt_123',
-      };
-
-      vi.mocked(getToken).mockReturnValue(tokenMissingOrgClaims);
-      vi.mocked(getOrgScopedToken).mockResolvedValue({
-        jwt: 'org_scoped_jwt',
-      });
-      vi.mocked(parseJWT).mockReturnValue({
-        exp: futureExp,
-        o: { o_id: 'org_456' },
-      });
-
-      await loadAndRefreshToken();
-
-      expect(saveToken).toHaveBeenCalledWith(
-        expect.objectContaining({
-          idToken: 'org_scoped_jwt',
-        })
-      );
-    });
-  });
-
-  describe('OAuth refresh fallback for missing sid', () => {
-    const originalFetch = global.fetch;
-
-    afterEach(() => {
-      global.fetch = originalFetch;
-    });
-
-    it('attempts OAuth refresh when no sid/originalSid but has refresh_token', async () => {
-      const tokenNoSid = {
-        idToken: 'token_no_sid',
-        decoded: { exp: futureExp }, // No sid
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
+  describe('valid token handling', () => {
+    it('returns token data when not expired', async () => {
+      const validToken = {
+        idToken: 'valid_token',
+        decoded: { exp: futureExp, sub: 'user_123' },
         refresh_token: 'rt_123',
-        // No originalSid either
       };
 
-      vi.mocked(getToken).mockReturnValue(tokenNoSid);
-
-      // Mock fetch for OAuth refresh
-      global.fetch = vi.fn().mockResolvedValue({
-        ok: true,
-        json: () => Promise.resolve({
-          access_token: 'new_at',
-          id_token: 'new_idt_with_sid',
-          refresh_token: 'new_rt',
-        }),
-      });
-
-      // parseJWT returns token with sid after refresh
-      vi.mocked(parseJWT)
-        .mockReturnValueOnce({ exp: futureExp, sid: 'sess_new' }) // First call: parse refreshed token
-        .mockReturnValueOnce({ exp: futureExp, o: { o_id: 'org_456' } }); // Second call: parse org-scoped token
-
-      vi.mocked(getOrgScopedToken).mockResolvedValue({
-        jwt: 'org_scoped_jwt_after_refresh',
-      });
-
-      await loadAndRefreshToken();
-
-      expect(global.fetch).toHaveBeenCalledWith(
-        expect.stringContaining('/oauth/token'),
-        expect.any(Object)
-      );
-    });
-
-    it('continues without org token when OAuth refresh fails', async () => {
-      const tokenNoSid = {
-        idToken: 'token_no_sid',
-        decoded: { exp: futureExp },
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-        refresh_token: 'rt_123',
-      };
+      vi.mocked(getToken).mockReturnValue(validToken);
+      vi.mocked(isTokenExpired).mockReturnValue(false);
 
-      vi.mocked(getToken).mockReturnValue(tokenNoSid);
-
-      // Mock fetch to fail
-      global.fetch = vi.fn().mockResolvedValue({
-        ok: false,
-        status: 400,
-      });
-
-      // Should not throw, just return token as-is
       const result = await loadAndRefreshToken();
 
-      expect(result).toBeDefined();
-      expect(result.idToken).toBe('token_no_sid');
+      expect(refreshAccessToken).not.toHaveBeenCalled();
+      expect(result).toEqual(validToken);
     });
 
-    it('logs warning when no recovery path available', async () => {
-      const fullyBrokenToken = {
-        idToken: 'broken_token',
-        decoded: { exp: futureExp },
-        selectedOrg: { id: 'org_456', name: 'Test Org' },
-        // No sid, no originalSid, no refresh_token
+    it('returns token with org context when present', async () => {
+      const orgToken = {
+        idToken: 'org_token',
+        decoded: { exp: futureExp, sub: 'user_123', org_id: 'org_456' },
+        selectedOrgId: 'org_456',
+        selectedOrgName: 'Test Org',
+        refresh_token: 'rt_123',
       };
 
-      vi.mocked(getToken).mockReturnValue(fullyBrokenToken);
-
-      // Spy on console.error
-      const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+      vi.mocked(getToken).mockReturnValue(orgToken);
+      vi.mocked(isTokenExpired).mockReturnValue(false);
 
       const result = await loadAndRefreshToken();
 
-      // Should still return token (API calls may fail later)
-      expect(result).toBeDefined();
-
-      // Should have logged warning about missing session ID
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining('Could not obtain session ID')
-      );
-
-      consoleSpy.mockRestore();
+      expect(result.selectedOrgId).toBe('org_456');
+      expect(result.selectedOrgName).toBe('Test Org');
     });
   });
 });