atris 3.58.5 → 3.58.7

package/utils/auth.js

@@ -202,6 +202,51 @@ function loadPlacedAgentToken() {
   }
 }
 
+function leftoverStoredAgentToken(parsed, envToken) {
+  if (!parsed || !envToken) return null;
+  const leftover = typeof parsed.agent_token === 'string' ? parsed.agent_token.trim() : '';
+  if (!leftover || leftover !== envToken) return null;
+  const expiresAt = parsed.agent_token_expires_at;
+  if (expiryTimeMs(expiresAt) === null) return null;
+  const scopes = Array.isArray(parsed.agent_token_scopes) ? parsed.agent_token_scopes : [];
+  return {
+    token: leftover,
+    expires_at: expiresAt,
+    scopes,
+    provider: null,
+    source: 'env',
+    agent_token: leftover,
+    agent_token_scopes: scopes,
+    agent_token_expires_at: expiresAt,
+  };
+}
+
+function loadLeftoverCredentialsAgentToken(envToken) {
+  if (!envToken) return null;
+  try {
+    return leftoverStoredAgentToken(JSON.parse(fs.readFileSync(getCredentialsPath(), 'utf8')), envToken);
+  } catch {
+    return null;
+  }
+}
+
+function resolveProfileOverride(profileOverride) {
+  if (!profileOverride) return null;
+  if (loadProfile(profileOverride)) return profileOverride;
+  const profiles = listProfiles();
+  const q = String(profileOverride).toLowerCase();
+  return profiles.find((name) => name.toLowerCase() === q)
+    || profiles.find((name) => name.toLowerCase().startsWith(q))
+    || profiles.find((name) => name.toLowerCase().includes(q))
+    || null;
+}
+
+function loadLeftoverProfileAgentToken(envToken) {
+  const name = resolveProfileOverride(process.env.ATRIS_PROFILE) || getSessionProfile();
+  if (!envToken || !name) return null;
+  return leftoverStoredAgentToken(loadProfile(name), envToken);
+}
+
 function isUnexpiredCredential(credentials) {
   const expiresAt = expiryTimeMs(credentials?.expires_at);
   return expiresAt !== null && expiresAt > Date.now();
@@ -352,9 +397,13 @@ function autoSaveProfile(credentials) {
   }
 }
 
-function saveCredentials(token, refreshToken, email, userId, provider) {
+function saveCredentials(token, refreshToken, email, userId, provider, extras = {}) {
+  if (decodeJwtClaims(token)?.type === 'agent_access') {
+    throw new Error('Refusing to save a scoped agent token as the login token; keep it under agent_token');
+  }
   const credentialsPath = getCredentialsPath();
   const credentials = {
+    ...extras,
     token,
     refresh_token: refreshToken || null,
     email: email || null,
@@ -374,10 +423,47 @@ function saveCredentials(token, refreshToken, email, userId, provider) {
   autoSaveProfile(credentials);
 }
 
-function loadCredentials() {
+// Supplying the auth client enables asynchronous repair. Local-only readers stay synchronous.
+function loadCredentials(apiRequestJson) {
+  const credentials = readCredentials();
+  if (!credentials || credentials.source || decodeJwtClaims(credentials.token)?.type !== 'agent_access') {
+    return credentials;
+  }
+  if (!credentials.refresh_token) {
+    console.error('atris login');
+    return credentials;
+  }
+  if (!apiRequestJson) return credentials;
+  return repairLoginCredentials(credentials, apiRequestJson);
+}
+
+async function repairLoginCredentials(credentials, apiRequestJson) {
+  const refreshed = await refreshAccessToken(credentials.refresh_token, null, apiRequestJson);
+  const token = refreshed.data?.access_token;
+  if (!refreshed.ok || !token || decodeJwtClaims(token)?.type === 'agent_access') {
+    throw new Error('Could not repair login file. Run atris login');
+  }
+  const claims = decodeJwtClaims(credentials.token);
+  const { source_profile, ...rest } = credentials;
+  const next = {
+    ...rest,
+    token,
+    refresh_token: refreshed.data.refresh_token || credentials.refresh_token,
+    agent_token: credentials.token,
+    agent_token_scopes: claims.scopes || [],
+    agent_token_expires_at: typeof claims.exp === 'number' ? new Date(claims.exp * 1000).toISOString() : null,
+  };
+  if (source_profile) saveProfile(source_profile, next);
+  else saveCredentials(token, next.refresh_token, next.email, next.user_id, next.provider, next);
+  console.error('Repaired login file: moved a scoped agent token aside.');
+  return { ...next, ...(source_profile ? { source_profile } : {}) };
+}
+
+function readCredentials() {
   // Priority: ATRIS_TOKEN env var → placed agent token → ATRIS_PROFILE env var
   // → per-terminal session file → global credentials.json. A fresh placed token
-  // overrides a different env token because cloud images can carry a stale one.
+  // overrides env when the leftover is newer or when env only repeats that
+  // leftover, so billed auth still sees leftover scopes.
 
   // 0. Raw token injection. Headless boxes (cloud business computers) have no
   //    browser for `atris login`; the runner injects a scoped token as env
@@ -385,15 +471,24 @@ function loadCredentials() {
   const envToken = process.env.ATRIS_TOKEN;
   const normalizedEnvToken = envToken && envToken.trim();
   const placedAgentToken = loadPlacedAgentToken();
-  if (
-    normalizedEnvToken &&
-    placedAgentToken &&
-    placedAgentToken.token !== normalizedEnvToken &&
-    isUnexpiredCredential(placedAgentToken)
-  ) {
+  if (normalizedEnvToken && placedAgentToken && isUnexpiredCredential(placedAgentToken)) {
+    // Fresh placed leftover wins over env, including when env repeats the same
+    // token, so billed auth still sees leftover scopes and does not remint.
     return placedAgentToken;
   }
   if (normalizedEnvToken) {
+    const leftoverCredentials = loadLeftoverCredentialsAgentToken(normalizedEnvToken);
+    if (leftoverCredentials && isUnexpiredCredential(leftoverCredentials)) {
+      // Env repeating leftover credentials.agent_token keeps leftover scopes
+      // and expiry so billed auth does not remint.
+      return leftoverCredentials;
+    }
+    const leftoverProfile = loadLeftoverProfileAgentToken(normalizedEnvToken);
+    if (leftoverProfile && isUnexpiredCredential(leftoverProfile)) {
+      // Env repeating leftover profile or session-profile agent_token keeps
+      // leftover scopes and expiry so billed auth does not remint.
+      return leftoverProfile;
+    }
     return { token: normalizedEnvToken, provider: null, source: 'env' };
   }
 
@@ -552,7 +647,7 @@ async function performTokenRefresh(credentials, apiRequestJson) {
         saved_at: new Date().toISOString(),
       });
     } else {
-      saveCredentials(accessToken, newRefreshToken, email, userId, provider);
+      saveCredentials(accessToken, newRefreshToken, email, userId, provider, credentials);
     }
   };
 
@@ -586,7 +681,7 @@ async function performTokenRefresh(credentials, apiRequestJson) {
           saved_at: new Date().toISOString(),
         });
       } else {
-        saveCredentials(accessToken, newRefreshToken, updatedEmail, updatedUserId, updatedProvider);
+        saveCredentials(accessToken, newRefreshToken, updatedEmail, updatedUserId, updatedProvider, credentials);
       }
       latestCreds = loadCredentials();
     }
@@ -603,7 +698,7 @@ async function performTokenRefresh(credentials, apiRequestJson) {
 }
 
 async function ensureValidCredentials(apiRequestJson, options = {}) {
-  let credentials = loadCredentials();
+  let credentials = await loadCredentials(apiRequestJson);
   if (!credentials || !credentials.token) {
     return { error: 'not_logged_in' };
   }
@@ -659,7 +754,8 @@ async function ensureValidCredentials(apiRequestJson, options = {}) {
           credentials.refresh_token,
           updatedEmail,
           updatedUserId,
-          updatedProvider
+          updatedProvider,
+          credentials
         );
       }
     }