arcadible 1.0.7 → 1.0.9

package/package.json

@@ -65,5 +65,5 @@
   "scripts": {
     "test": "node --test \"test/**/*.test.js\""
   },
-  "version": "1.0.7"
+  "version": "1.0.9"
 }

package/src/account.js

@@ -64,7 +64,7 @@ const expired = function (session) {
 // the session is a credential, so only its owner can read it: the directory
 // is 0700 and the file 0600. `mode` only applies when a file is created, so
 // both are also set on every save, which fixes an older, readable file. The
-// modes are ignored on Windows, where %APPDATA% is already private.
+// modes are ignored on Windows, where %LOCALAPPDATA% is already private.
 const save = function (current) {
   return mkdir(dir, { mode: DIR_MODE, recursive: true })
     .then(() => chmod(dir, DIR_MODE))
@@ -168,10 +168,13 @@ const get = function (onRefresh) {
 // [function]
 
 // a failed request's handler for commands that send the saved session's
-// token: the API refuses it (401) only when Supabase does, such as for a
-// deleted account, so the session is over. It's removed, and the error says
-// to log in, rather than api_refused. An ARC_TOKEN's refusal stays as it is,
-// since logging in doesn't change the token.
+// token. The API refuses it (401) only when Supabase does: for a deleted
+// account, or a token that expired by the server's clock though not by
+// this one's. A refresh tells them apart: refused, the session is over, so
+// it's removed and the error says to log in (session_expired); renewed, the
+// session is kept, and the request's own error stands, so running the
+// command again works. An ARC_TOKEN's refusal stays as it is, since logging
+// in doesn't change the token.
 const ended = function (current) {
   return (ex) => {
     if (
@@ -182,7 +185,14 @@ const ended = function (current) {
     ) {
       throw ex;
     }
-    return expire(ex);
+    return refresh(current).then(
+      () => {
+        throw ex;
+      },
+      (refreshEx) => {
+        throw refreshEx instanceof ArcError ? refreshEx : ex;
+      },
+    );
   };
 };
 

package/src/util/os.js

@@ -12,9 +12,12 @@ const join = path.join;
 
 // [function]
 
+// on Windows, the machine's own folder (%LOCALAPPDATA%), not the roaming one:
+// the session is a credential, and the SDK's copy a cache, neither of which
+// should follow a roaming profile to other machines
 const configDir = function () {
   if (process.platform === "win32") {
-    return process.env.APPDATA;
+    return process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local");
   }
   return join(homedir(), ".config");
 };