@youkno/edge-cli 1.21.331 → 1.21.332

package/dist/lib/auth.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShellAuthMethodError = void 0;
 exports.listLogins = listLogins;
 exports.setDefaultLogin = setDefaultLogin;
 exports.logout = logout;
@@ -161,6 +162,65 @@ function extractEmailFromToken(accessToken) {
     }
     return "unknown@local";
 }
+/**
+ * The server's `errorCode` for "you signed in a way the shell does not accept". Mirrors
+ * `ApiErrorCode.SHELL_AUTH_METHOD_NOT_ALLOWED`. Matched on the number rather than the message so a
+ * reworded refusal does not silently stop being recognised here.
+ */
+const ERROR_CODE_SHELL_AUTH_METHOD = 403006;
+/**
+ * The RFC 7807 body an Edge API error carries, or undefined if this one did not send one (a proxy
+ * error page, an HTML 502). Never throws -- a failure to parse the explanation of a failure must not
+ * replace it with a parse error.
+ */
+function parseProblemDetail(body) {
+    try {
+        const parsed = JSON.parse(body);
+        return parsed && typeof parsed === "object" ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+class AuthEndpointError extends Error {
+    status;
+    problem;
+    constructor(message, status, problem) {
+        super(message);
+        this.status = status;
+        this.problem = problem;
+        this.name = "AuthEndpointError";
+    }
+}
+/**
+ * The server refused the sign-in METHOD rather than the identity: this session was created with, or
+ * is being used from, a login the shell does not accept.
+ *
+ * Its own type because it is the one auth failure the operator can act on immediately, and because
+ * it must survive `resolveAccessToken`'s "a failed refresh is not fatal" handling, which otherwise
+ * swallows it and falls through to an access token that is already dead.
+ */
+class ShellAuthMethodError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ShellAuthMethodError";
+    }
+}
+exports.ShellAuthMethodError = ShellAuthMethodError;
+/**
+ * The refusal as a clean error, or undefined when this failure is something else.
+ *
+ * The server has already written the sentence the operator needs -- which methods are accepted, and
+ * that they should log in again -- so it is surfaced as-is rather than buried inside
+ * `Auth refresh failed (403): {"type":...}`. Matched on errorCode, never on the prose.
+ */
+function asShellAuthMethodError(err, hint) {
+    if (!(err instanceof AuthEndpointError) || err.problem?.errorCode !== ERROR_CODE_SHELL_AUTH_METHOD) {
+        return undefined;
+    }
+    const detail = err.problem.detail ?? err.problem.title ?? "Shell access requires a different sign-in method.";
+    return new ShellAuthMethodError(`${detail}${hint}`);
+}
 async function requestTokenEndpoint(cfg, endpoint, payload) {
     const url = `${cfg.baseUrl.replace(/\/$/, "")}/api/v1/auth/${endpoint}`;
     const response = await fetch(url, {
@@ -173,7 +233,7 @@ async function requestTokenEndpoint(cfg, endpoint, payload) {
     });
     if (!response.ok) {
         const body = await response.text();
-        throw new Error(`Auth ${endpoint} failed (${response.status}): ${body}`);
+        throw new AuthEndpointError(`Auth ${endpoint} failed (${response.status}): ${body}`, response.status, parseProblemDetail(body));
     }
     if (endpoint === "logout") {
         return undefined;
@@ -229,6 +289,10 @@ async function exchangeCallbackToken(cfg, callbackToken) {
         return await authExchangeFirebaseToken(cfg, callbackToken);
     }
     catch (err) {
+        const refusal = asShellAuthMethodError(err, "");
+        if (refusal) {
+            throw refusal;
+        }
         const reason = err instanceof Error ? err.message : String(err);
         // The identity hint only fits a 401. On a network error or a 5xx, telling someone to check
         // which account they used is misdirection -- the same species of misleading report this
@@ -543,7 +607,16 @@ async function refreshDefaultToken(cfg) {
     if (!account?.refreshToken) {
         return undefined;
     }
-    const refreshed = await authRefreshToken(cfg, account.refreshToken);
+    let refreshed;
+    try {
+        refreshed = await authRefreshToken(cfg, account.refreshToken);
+    }
+    catch (err) {
+        // The common case for this refusal is not a fresh login but an existing session on the day
+        // the gate ships: the server revokes it on first refresh, and without this the operator gets
+        // the raw ProblemDetail JSON after two wasted round-trips.
+        throw asShellAuthMethodError(err, `\nRun 'edge-cli --product ${cfg.product} login' to sign in again.`) ?? err;
+    }
     const merged = {
         accessToken: refreshed.accessToken,
         refreshToken: refreshed.refreshToken || account.refreshToken,
@@ -580,7 +653,13 @@ async function resolveAccessToken(cfg, forceRefresh = false, skipValidate = fals
                 accessToken = refreshed;
             }
         }
-        catch {
+        catch (err) {
+            // A failed refresh is ordinarily not fatal -- the existing token may still have a minute
+            // on it. The method refusal is different: the session is revoked server-side, so falling
+            // through here only trades one clear error for a confusing 401 from whatever comes next.
+            if (err instanceof ShellAuthMethodError) {
+                throw err;
+            }
             // continue with existing token
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youkno/edge-cli",
-  "version": "1.21.331",
+  "version": "1.21.332",
   "description": "Cross-platform Edge CLI",
   "bin": "dist/index.js",
   "publishConfig": {

package/src/lib/auth.ts

@@ -205,6 +205,74 @@ function extractEmailFromToken(accessToken: string): string {
     return "unknown@local";
 }
 
+/**
+ * The server's `errorCode` for "you signed in a way the shell does not accept". Mirrors
+ * `ApiErrorCode.SHELL_AUTH_METHOD_NOT_ALLOWED`. Matched on the number rather than the message so a
+ * reworded refusal does not silently stop being recognised here.
+ */
+const ERROR_CODE_SHELL_AUTH_METHOD = 403006;
+
+interface ProblemDetail {
+    title?: string;
+    detail?: string;
+    errorCode?: number;
+}
+
+/**
+ * The RFC 7807 body an Edge API error carries, or undefined if this one did not send one (a proxy
+ * error page, an HTML 502). Never throws -- a failure to parse the explanation of a failure must not
+ * replace it with a parse error.
+ */
+function parseProblemDetail(body: string): ProblemDetail | undefined {
+    try {
+        const parsed = JSON.parse(body);
+        return parsed && typeof parsed === "object" ? (parsed as ProblemDetail) : undefined;
+    } catch {
+        return undefined;
+    }
+}
+
+class AuthEndpointError extends Error {
+    constructor(
+        message: string,
+        readonly status: number,
+        readonly problem?: ProblemDetail
+    ) {
+        super(message);
+        this.name = "AuthEndpointError";
+    }
+}
+
+/**
+ * The server refused the sign-in METHOD rather than the identity: this session was created with, or
+ * is being used from, a login the shell does not accept.
+ *
+ * Its own type because it is the one auth failure the operator can act on immediately, and because
+ * it must survive `resolveAccessToken`'s "a failed refresh is not fatal" handling, which otherwise
+ * swallows it and falls through to an access token that is already dead.
+ */
+export class ShellAuthMethodError extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = "ShellAuthMethodError";
+    }
+}
+
+/**
+ * The refusal as a clean error, or undefined when this failure is something else.
+ *
+ * The server has already written the sentence the operator needs -- which methods are accepted, and
+ * that they should log in again -- so it is surfaced as-is rather than buried inside
+ * `Auth refresh failed (403): {"type":...}`. Matched on errorCode, never on the prose.
+ */
+function asShellAuthMethodError(err: unknown, hint: string): ShellAuthMethodError | undefined {
+    if (!(err instanceof AuthEndpointError) || err.problem?.errorCode !== ERROR_CODE_SHELL_AUTH_METHOD) {
+        return undefined;
+    }
+    const detail = err.problem.detail ?? err.problem.title ?? "Shell access requires a different sign-in method.";
+    return new ShellAuthMethodError(`${detail}${hint}`);
+}
+
 async function requestTokenEndpoint(
     cfg: EffectiveConfig,
     endpoint: "exchange" | "refresh" | "logout",
@@ -222,7 +290,11 @@ async function requestTokenEndpoint(
 
     if (!response.ok) {
         const body = await response.text();
-        throw new Error(`Auth ${endpoint} failed (${response.status}): ${body}`);
+        throw new AuthEndpointError(
+            `Auth ${endpoint} failed (${response.status}): ${body}`,
+            response.status,
+            parseProblemDetail(body)
+        );
     }
 
     if (endpoint === "logout") {
@@ -287,6 +359,11 @@ async function exchangeCallbackToken(cfg: EffectiveConfig, callbackToken: string
     try {
         return await authExchangeFirebaseToken(cfg, callbackToken);
     } catch (err) {
+        const refusal = asShellAuthMethodError(err, "");
+        if (refusal) {
+            throw refusal;
+        }
+
         const reason = err instanceof Error ? err.message : String(err);
         // The identity hint only fits a 401. On a network error or a 5xx, telling someone to check
         // which account they used is misdirection -- the same species of misleading report this
@@ -646,7 +723,16 @@ async function refreshDefaultToken(cfg: EffectiveConfig): Promise<string | undef
         return undefined;
     }
 
-    const refreshed = await authRefreshToken(cfg, account.refreshToken);
+    let refreshed: TokenResponse;
+    try {
+        refreshed = await authRefreshToken(cfg, account.refreshToken);
+    } catch (err) {
+        // The common case for this refusal is not a fresh login but an existing session on the day
+        // the gate ships: the server revokes it on first refresh, and without this the operator gets
+        // the raw ProblemDetail JSON after two wasted round-trips.
+        throw asShellAuthMethodError(err, `\nRun 'edge-cli --product ${cfg.product} login' to sign in again.`) ?? err;
+    }
+
     const merged: TokenResponse = {
         accessToken: refreshed.accessToken,
         refreshToken: refreshed.refreshToken || account.refreshToken,
@@ -686,7 +772,13 @@ export async function resolveAccessToken(cfg: EffectiveConfig, forceRefresh = fa
             if (refreshed) {
                 accessToken = refreshed;
             }
-        } catch {
+        } catch (err) {
+            // A failed refresh is ordinarily not fatal -- the existing token may still have a minute
+            // on it. The method refusal is different: the session is revoked server-side, so falling
+            // through here only trades one clear error for a confusing 401 from whatever comes next.
+            if (err instanceof ShellAuthMethodError) {
+                throw err;
+            }
             // continue with existing token
         }
     }