@youkno/edge-cli 1.21.290 → 1.21.292

package/dist/lib/auth.js

@@ -151,6 +151,38 @@ async function authRefreshToken(cfg, refreshToken) {
 async function authLogoutRefreshToken(cfg, refreshToken) {
     await requestTokenEndpoint(cfg, "logout", { refreshToken });
 }
+/**
+ * Turn whatever the console callback handed us into first-party tokens.
+ *
+ * The console redirects with `?jwt=<firebase id token>`, and parseCallbackQuery reads `jwt` as
+ * accessToken -- so the callback never populates `firebaseToken` and we used to store that Firebase
+ * token raw. Two consequences, both bad: a Firebase ID token lives exactly one hour and Google
+ * decides that, not us; and the callback carries no refresh token, so every refresh path in
+ * resolveAccessToken is guarded off and the session cannot recover. The CLI simply died after an
+ * hour with "Firebase ID token has expired" and the only cure was logging in again.
+ *
+ * Exchanging it gets a first-party access token plus a refresh token (30 days by default), which
+ * resolveAccessToken already rotates automatically.
+ *
+ * Falls back to storing the token as-is when the exchange is unavailable -- an older server without
+ * /auth/exchange, or one with auth.issueFirstPartyTokens disabled -- so login still works there,
+ * with the same one-hour life it always had.
+ */
+async function exchangeCallbackToken(cfg, callbackToken) {
+    try {
+        return await authExchangeFirebaseToken(cfg, callbackToken);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stdout.write(`Warning: could not exchange for a first-party token (${reason}).\n` +
+            `Falling back to the raw callback token, which expires in about an hour and cannot be refreshed.\n`);
+        return {
+            accessToken: callbackToken,
+            accessTokenExpiresInSec: 3600,
+            refreshTokenExpiresInSec: 0
+        };
+    }
+}
 async function logout(cfg, email) {
     const db = readDb();
     const scope = getScope(db, cfg);
@@ -344,14 +376,19 @@ async function login(cfg) {
     if (parsed.firebaseToken) {
         tokenResp = await authExchangeFirebaseToken(cfg, parsed.firebaseToken);
     }
-    else if (parsed.accessToken) {
+    else if (parsed.accessToken && parsed.refreshToken) {
+        // Already a first-party pair; nothing to exchange.
         tokenResp = {
             accessToken: parsed.accessToken,
             refreshToken: parsed.refreshToken,
             accessTokenExpiresInSec: 3600,
-            refreshTokenExpiresInSec: parsed.refreshToken ? 2_592_000 : 0
+            refreshTokenExpiresInSec: 2_592_000
         };
     }
+    else if (parsed.accessToken) {
+        // No refresh token alongside it means this is the console's `?jwt=` Firebase token.
+        tokenResp = await exchangeCallbackToken(cfg, parsed.accessToken);
+    }
     if (!tokenResp?.accessToken) {
         throw new Error("Authentication callback did not include usable token data.");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youkno/edge-cli",
-  "version": "1.21.290",
+  "version": "1.21.292",
   "description": "Cross-platform Edge CLI",
   "bin": "dist/index.js",
   "publishConfig": {

package/src/lib/auth.ts

@@ -187,6 +187,40 @@ async function authLogoutRefreshToken(cfg: EffectiveConfig, refreshToken: string
     await requestTokenEndpoint(cfg, "logout", { refreshToken });
 }
 
+/**
+ * Turn whatever the console callback handed us into first-party tokens.
+ *
+ * The console redirects with `?jwt=<firebase id token>`, and parseCallbackQuery reads `jwt` as
+ * accessToken -- so the callback never populates `firebaseToken` and we used to store that Firebase
+ * token raw. Two consequences, both bad: a Firebase ID token lives exactly one hour and Google
+ * decides that, not us; and the callback carries no refresh token, so every refresh path in
+ * resolveAccessToken is guarded off and the session cannot recover. The CLI simply died after an
+ * hour with "Firebase ID token has expired" and the only cure was logging in again.
+ *
+ * Exchanging it gets a first-party access token plus a refresh token (30 days by default), which
+ * resolveAccessToken already rotates automatically.
+ *
+ * Falls back to storing the token as-is when the exchange is unavailable -- an older server without
+ * /auth/exchange, or one with auth.issueFirstPartyTokens disabled -- so login still works there,
+ * with the same one-hour life it always had.
+ */
+async function exchangeCallbackToken(cfg: EffectiveConfig, callbackToken: string): Promise<TokenResponse> {
+    try {
+        return await authExchangeFirebaseToken(cfg, callbackToken);
+    } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stdout.write(
+            `Warning: could not exchange for a first-party token (${reason}).\n` +
+            `Falling back to the raw callback token, which expires in about an hour and cannot be refreshed.\n`
+        );
+        return {
+            accessToken: callbackToken,
+            accessTokenExpiresInSec: 3600,
+            refreshTokenExpiresInSec: 0
+        };
+    }
+}
+
 export async function logout(cfg: EffectiveConfig, email?: string): Promise<string> {
     const db = readDb();
     const scope = getScope(db, cfg);
@@ -404,13 +438,17 @@ export async function login(cfg: EffectiveConfig): Promise<string> {
     let tokenResp: TokenResponse | undefined;
     if (parsed.firebaseToken) {
         tokenResp = await authExchangeFirebaseToken(cfg, parsed.firebaseToken);
-    } else if (parsed.accessToken) {
+    } else if (parsed.accessToken && parsed.refreshToken) {
+        // Already a first-party pair; nothing to exchange.
         tokenResp = {
             accessToken: parsed.accessToken,
             refreshToken: parsed.refreshToken,
             accessTokenExpiresInSec: 3600,
-            refreshTokenExpiresInSec: parsed.refreshToken ? 2_592_000 : 0
+            refreshTokenExpiresInSec: 2_592_000
         };
+    } else if (parsed.accessToken) {
+        // No refresh token alongside it means this is the console's `?jwt=` Firebase token.
+        tokenResp = await exchangeCallbackToken(cfg, parsed.accessToken);
     }
 
     if (!tokenResp?.accessToken) {