brightspace-d2l-mcp 1.0.0

package/build/auth/authenticator.js

@@ -0,0 +1,146 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { loginWithBrowser, LoginError } from "./login.js";
+import { NoBrowserError, ProfileInUseError } from "./browser.js";
+import { loginLockPath, LOGIN_COMMAND, SETUP_COMMAND } from "../utils/paths.js";
+import { log } from "../utils/logger.js";
+export class AuthRequiredError extends Error {
+    kind;
+    constructor(kind, message, options) {
+        super(message, options);
+        this.kind = kind;
+        this.name = "AuthRequiredError";
+    }
+}
+const LOCK_STALE_MS = 12 * 60_000;
+const COOLDOWN_MS = 2 * 60_000;
+export class Authenticator {
+    options;
+    inFlight = null;
+    cooldownUntil = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    run() {
+        this.inFlight ??= this.authenticate().finally(() => { this.inFlight = null; });
+        return this.inFlight;
+    }
+    async authenticate() {
+        const { baseUrl, tokenManager } = this.options;
+        if (!baseUrl) {
+            throw new AuthRequiredError("notConfigured", `Brightspace is not set up yet. Run \`${SETUP_COMMAND}\` in a terminal.`);
+        }
+        if (Date.now() < this.cooldownUntil) {
+            throw new AuthRequiredError("cancelled", `Sign-in was cancelled recently. Run \`${LOGIN_COMMAND}\` in a terminal, or ask again in a couple of minutes.`);
+        }
+        const lock = await acquireLock();
+        if (!lock) {
+            // Another process signed in (or is signing in) for us; use what it saved.
+            return (await tokenManager.getToken()) !== null;
+        }
+        try {
+            // Another process may have finished just before we got the lock.
+            if (await tokenManager.getToken())
+                return true;
+            return await this.signIn();
+        }
+        finally {
+            lock.release();
+        }
+    }
+    async signIn() {
+        const { baseUrl, tokenTtl, autoLogin, tokenManager } = this.options;
+        const notify = this.options.notify ?? (() => { });
+        try {
+            log("INFO", "Trying silent sign-in with the saved browser profile");
+            const { token } = await loginWithBrowser({ baseUrl, mode: "silent", tokenTtlSeconds: tokenTtl });
+            await tokenManager.setToken(token);
+            log("INFO", "Silent sign-in succeeded");
+            return true;
+        }
+        catch (error) {
+            if (!(error instanceof LoginError && error.kind === "needsInteraction"))
+                throw toAuthError(error);
+        }
+        if (!autoLogin) {
+            throw new AuthRequiredError("loginRequired", `Your Brightspace session expired. Run \`${LOGIN_COMMAND}\` in a terminal to sign in again.`);
+        }
+        try {
+            notify("Your Brightspace session expired. A browser window is opening so you can sign in again.");
+            const { token, displayName } = await loginWithBrowser({ baseUrl, mode: "interactive", tokenTtlSeconds: tokenTtl, onStatus: notify });
+            await tokenManager.setToken(token);
+            log("INFO", `Interactive sign-in succeeded${displayName ? ` for ${displayName}` : ""}`);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof LoginError && (error.kind === "cancelled" || error.kind === "timeout")) {
+                this.cooldownUntil = Date.now() + COOLDOWN_MS;
+            }
+            throw toAuthError(error);
+        }
+    }
+}
+function toAuthError(error) {
+    if (error instanceof AuthRequiredError)
+        return error;
+    if (error instanceof NoBrowserError)
+        return new AuthRequiredError("noBrowser", error.message, { cause: error });
+    if (error instanceof ProfileInUseError)
+        return new AuthRequiredError("busy", error.message, { cause: error });
+    if (error instanceof LoginError) {
+        const guidance = {
+            cancelled: ["cancelled", "The sign-in window was closed before signing in finished."],
+            timeout: ["timeout", "Sign-in was not completed within 10 minutes."],
+            needsInteraction: ["loginRequired", "Your Brightspace session expired."],
+            network: ["network", "Brightspace could not be reached. Check your connection and try again."],
+            failed: ["failed", "Signing in to Brightspace did not complete."],
+        };
+        const [kind, text] = guidance[error.kind];
+        return new AuthRequiredError(kind, `${text} Run \`${LOGIN_COMMAND}\` in a terminal to sign in.`, { cause: error });
+    }
+    log("ERROR", "Unexpected sign-in failure", error);
+    return new AuthRequiredError("failed", `Signing in to Brightspace did not complete. Run \`${LOGIN_COMMAND}\` in a terminal to sign in.`, { cause: error });
+}
+async function acquireLock() {
+    const file = loginLockPath();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    let waited = false;
+    const deadline = Date.now() + LOCK_STALE_MS;
+    while (Date.now() < deadline) {
+        try {
+            const fd = fs.openSync(file, "wx", 0o600);
+            fs.writeSync(fd, JSON.stringify({ pid: process.pid, startedAt: Date.now() }));
+            fs.closeSync(fd);
+            if (waited) {
+                fs.rmSync(file, { force: true });
+                return null;
+            }
+            return { release: () => fs.rmSync(file, { force: true }) };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        if (lockIsStale(file)) {
+            fs.rmSync(file, { force: true });
+            continue;
+        }
+        waited = true;
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+    throw new AuthRequiredError("busy", "Another sign-in is still in progress. Finish it, then try again.");
+}
+function lockIsStale(file) {
+    try {
+        const { pid, startedAt } = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (Date.now() - startedAt > LOCK_STALE_MS)
+            return true;
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        // ESRCH: the owner died. Unreadable: a crash mid-write.
+        return error?.code !== "EPERM";
+    }
+}
+//# sourceMappingURL=authenticator.js.map

package/build/auth/browser.js

@@ -0,0 +1,82 @@
+import * as fs from "node:fs";
+import { browserProfileDir } from "../utils/paths.js";
+import { log } from "../utils/logger.js";
+export class NoBrowserError extends Error {
+    constructor(detail) {
+        super("No supported browser was found. Install Google Chrome or Microsoft Edge, " +
+            "or run `npx playwright install chromium`, then try again." + (detail ? ` (${detail})` : ""));
+        this.name = "NoBrowserError";
+    }
+}
+export class ProfileInUseError extends Error {
+    constructor() {
+        super("The sign-in browser is already open. Finish signing in there, or close it and try again.");
+        this.name = "ProfileInUseError";
+    }
+}
+function candidates() {
+    const custom = process.env.BRIGHTSPACE_BROWSER_PATH;
+    if (custom)
+        return [{ label: custom, executablePath: custom }];
+    return [
+        { label: "Google Chrome", channel: "chrome" },
+        { label: "Microsoft Edge", channel: "msedge" },
+        { label: "Chromium (Playwright)" },
+    ];
+}
+let preferred = null;
+function isMissingExecutable(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /Executable doesn't exist|is not found at|not installed|Chromium distribution .* is not found|Failed to launch/i.test(message)
+        && !isProfileInUse(error);
+}
+function isProfileInUse(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /ProcessSingleton|profile (?:appears to be )?in use|user data directory is already in use|SingletonLock/i.test(message);
+}
+export async function launchBrowser(options) {
+    const { chromium } = await import("playwright-core");
+    const profile = browserProfileDir();
+    fs.mkdirSync(profile, { recursive: true, mode: 0o700 });
+    const order = preferred ? [preferred, ...candidates().filter((c) => c.label !== preferred.label)] : candidates();
+    const failures = [];
+    for (const candidate of order) {
+        try {
+            const context = await chromium.launchPersistentContext(profile, {
+                headless: options.headless,
+                channel: candidate.channel,
+                executablePath: candidate.executablePath,
+                viewport: options.headless ? { width: 1280, height: 800 } : null,
+                ignoreDefaultArgs: ["--enable-automation"],
+                args: ["--disable-blink-features=AutomationControlled", "--no-first-run", "--no-default-browser-check"],
+                timeout: 60_000,
+            });
+            preferred = candidate;
+            log("DEBUG", `Launched ${candidate.label} (${options.headless ? "hidden" : "visible"})`);
+            if (options.headless)
+                await hideHeadlessUserAgent(context);
+            return context;
+        }
+        catch (error) {
+            if (isProfileInUse(error))
+                throw new ProfileInUseError();
+            if (!isMissingExecutable(error))
+                throw error;
+            failures.push(candidate.label);
+        }
+    }
+    throw new NoBrowserError(`tried ${failures.join(", ")}`);
+}
+async function hideHeadlessUserAgent(context) {
+    try {
+        const page = context.pages()[0] ?? (await context.newPage());
+        const ua = await page.evaluate(() => navigator.userAgent);
+        if (ua.includes("HeadlessChrome")) {
+            await context.setExtraHTTPHeaders({ "user-agent": ua.replace("HeadlessChrome", "Chrome") });
+        }
+    }
+    catch (error) {
+        log("DEBUG", "Could not adjust headless user agent", error);
+    }
+}
+//# sourceMappingURL=browser.js.map

package/build/auth/index.js

@@ -0,0 +1,6 @@
+export { TokenManager } from "./token-manager.js";
+export { SessionStore } from "./session-store.js";
+export { Authenticator, AuthRequiredError } from "./authenticator.js";
+export { loginWithBrowser, LoginError } from "./login.js";
+export { NoBrowserError } from "./browser.js";
+//# sourceMappingURL=index.js.map

package/build/auth/login.js

@@ -0,0 +1,227 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writeFileAtomic } from "../utils/atomic-write.js";
+import { savedCookiesPath } from "../utils/paths.js";
+import { readStoredConfig, writeStoredConfig } from "../utils/config.js";
+import { launchBrowser } from "./browser.js";
+import { mintAccessToken } from "./token-mint.js";
+import { log } from "../utils/logger.js";
+export class LoginError extends Error {
+    kind;
+    constructor(kind, message, options) {
+        super(message, options);
+        this.kind = kind;
+        this.name = "LoginError";
+    }
+}
+const POLL_MS = 1000;
+export async function loginWithBrowser(options) {
+    const origin = new URL(options.baseUrl).origin;
+    const interactive = options.mode === "interactive";
+    const timeoutMs = options.timeoutMs ?? (interactive ? 10 * 60_000 : 45_000);
+    const status = options.onStatus ?? (() => { });
+    const context = await launchBrowser({ headless: !interactive });
+    let closedByUser = false;
+    context.on("close", () => { closedByUser = true; });
+    // Remember which single sign-on entry the person used (an SSO button, a campus link),
+    // so silent sign-in can follow it without anyone clicking.
+    let ssoEntryUrl = null;
+    context.on("request", (request) => {
+        const url = safeUrl(request.url());
+        if (url && url.origin === origin && /^\/d2l\/lp\/auth\/saml\/(login|initiate-login)/i.test(url.pathname) && request.isNavigationRequest()) {
+            ssoEntryUrl = `${url.origin}${url.pathname}${url.search}`;
+        }
+    });
+    try {
+        await restoreCookies(context);
+        const page = context.pages()[0] ?? (await context.newPage());
+        if (interactive) {
+            await page.bringToFront().catch(() => { });
+            status("A browser window opened. Sign in to Brightspace there, the way you normally do.");
+        }
+        await page.goto(`${origin}/d2l/home`, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch((error) => {
+            // Single sign-on redirects can outlive the navigation timeout; keep watching.
+            log("DEBUG", "Initial navigation did not settle", error);
+        });
+        const stored = readStoredConfig();
+        const user = await waitForSession(context, origin, {
+            deadline: Date.now() + timeoutMs,
+            interactive,
+            isClosed: () => closedByUser,
+            ssoEntryUrl: stored.baseUrl === origin ? stored.ssoEntryUrl : undefined,
+        });
+        status(user.displayName ? `Signed in as ${user.displayName}.` : "Signed in.");
+        const token = await captureToken(context, activePage(context) ?? page, origin, options.tokenTtlSeconds ?? 3600);
+        await saveCookies(context);
+        if (interactive && ssoEntryUrl && stored.baseUrl === origin && stored.ssoEntryUrl !== ssoEntryUrl) {
+            writeStoredConfig({ ssoEntryUrl });
+        }
+        return { token, displayName: user.displayName };
+    }
+    catch (error) {
+        if (error instanceof LoginError)
+            throw error;
+        if (closedByUser)
+            throw new LoginError("cancelled", "The sign-in window was closed before signing in finished.");
+        throw new LoginError("failed", `Sign-in failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    finally {
+        if (!closedByUser)
+            await context.close().catch(() => { });
+    }
+}
+async function waitForSession(context, origin, watch) {
+    let offOriginSince = null;
+    let followedSsoEntry = false;
+    while (Date.now() < watch.deadline) {
+        if (watch.isClosed()) {
+            throw new LoginError("cancelled", "The sign-in window was closed before signing in finished.");
+        }
+        const page = activePage(context);
+        const url = safeUrl(page?.url());
+        if (url && url.origin === origin && url.pathname.startsWith("/d2l/") && !url.pathname.startsWith("/d2l/login")) {
+            const user = await whoami(context, origin);
+            if (user)
+                return user;
+        }
+        if (!watch.interactive) {
+            // A D2L login page that waits for a button click: follow the entry the person used last time.
+            if (page && url?.origin === origin && url.pathname.startsWith("/d2l/login") && watch.ssoEntryUrl && !followedSsoEntry) {
+                followedSsoEntry = true;
+                offOriginSince = null;
+                log("DEBUG", "Following the saved single sign-on entry");
+                await page.goto(watch.ssoEntryUrl, { waitUntil: "domcontentloaded", timeout: 30_000 }).catch(() => { });
+                continue;
+            }
+            // Silent mode: parked on an identity provider or the D2L login page means a person is needed.
+            const onLoginPage = !url || url.origin !== origin || url.pathname.startsWith("/d2l/login");
+            offOriginSince = onLoginPage ? offOriginSince ?? Date.now() : null;
+            if (offOriginSince && Date.now() - offOriginSince > 12_000) {
+                throw new LoginError("needsInteraction", "The saved sign-in has expired; a person needs to sign in.");
+            }
+        }
+        await sleep(POLL_MS);
+    }
+    throw new LoginError(watch.interactive ? "timeout" : "needsInteraction", watch.interactive ? "Sign-in was not completed in time." : "Silent sign-in did not finish.");
+}
+function activePage(context) {
+    const pages = context.pages().filter((p) => !p.isClosed());
+    const onBrightspace = pages.filter((p) => p.url().includes("/d2l/"));
+    return onBrightspace.at(-1) ?? pages.at(-1);
+}
+async function whoami(context, origin) {
+    try {
+        const response = await context.request.get(`${origin}/d2l/api/lp/1.0/users/whoami`, { timeout: 10_000, failOnStatusCode: false });
+        if (!response.ok() || !(response.headers()["content-type"] ?? "").includes("json"))
+            return null;
+        const body = (await response.json());
+        if (body?.Identifier === undefined || body.Identifier === null || body.Identifier === "")
+            return null;
+        const name = [body.FirstName, body.LastName].filter(Boolean).join(" ").trim();
+        return { displayName: name || null };
+    }
+    catch (error) {
+        log("DEBUG", "whoami check failed", error);
+        return null;
+    }
+}
+async function captureToken(context, page, origin, ttlSeconds) {
+    if (!page.url().startsWith(`${origin}/d2l/home`)) {
+        await page.goto(`${origin}/d2l/home`, { waitUntil: "domcontentloaded", timeout: 30_000 }).catch(() => { });
+    }
+    const cookies = await context.cookies(origin);
+    const pick = (name) => cookies.find((c) => c.name === name);
+    const session = pick("d2lSessionVal");
+    const secure = pick("d2lSecureSessionVal");
+    const cookieHeader = session && secure ? `d2lSessionVal=${session.value}; d2lSecureSessionVal=${secure.value}` : undefined;
+    const csrfToken = (await readXsrfToken(page)) ?? undefined;
+    const now = Date.now();
+    const build = (accessToken) => ({
+        accessToken,
+        tenantOrigin: origin,
+        capturedAt: now,
+        expiresAt: now + ttlSeconds * 1000,
+        source: "browser",
+        cookieHeader,
+        csrfToken,
+    });
+    if (cookieHeader && csrfToken) {
+        const minted = await mintAccessToken({ baseUrl: origin, cookieHeader, csrfToken });
+        if (minted.ok)
+            return build(minted.accessToken);
+        if (minted.reason === "transport") {
+            throw new LoginError("network", `Brightspace could not issue an API token right now (${minted.detail ?? "network"}).`);
+        }
+    }
+    // Fallback: the token Brightspace's own web app caches for itself.
+    const cached = await page.evaluate(() => {
+        try {
+            const tokens = JSON.parse(localStorage.getItem("D2L.Fetch.Tokens") ?? "null");
+            return tokens?.["*:*:*"]?.access_token ?? null;
+        }
+        catch {
+            return null;
+        }
+    }).catch(() => null);
+    if (cached)
+        return build(cached);
+    throw new LoginError("failed", "Signed in, but Brightspace did not provide an API token.");
+}
+async function readXsrfToken(page) {
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const token = await page.evaluate(() => {
+            try {
+                const xsrf = window
+                    .D2L?.LP?.Web?.Authentication?.Xsrf;
+                const value = xsrf?.GetXsrfToken?.call(xsrf);
+                if (value)
+                    return value;
+            }
+            catch {
+                // Not ready yet.
+            }
+            return document.querySelector('meta[name="d2l-xsrf-token"]')?.getAttribute("content") ?? null;
+        }).catch(() => null);
+        if (token)
+            return token;
+        await sleep(1000);
+    }
+    return null;
+}
+async function saveCookies(context) {
+    try {
+        const cookies = await context.cookies();
+        const file = savedCookiesPath();
+        await fs.promises.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        await writeFileAtomic(file, JSON.stringify(cookies), { mode: 0o600 });
+    }
+    catch (error) {
+        log("DEBUG", "Could not save sign-in cookies", error);
+    }
+}
+async function restoreCookies(context) {
+    let cookies;
+    try {
+        cookies = JSON.parse(await fs.promises.readFile(savedCookiesPath(), "utf8"));
+    }
+    catch {
+        return;
+    }
+    const now = Date.now() / 1000;
+    const live = cookies.filter((c) => c.expires === -1 || c.expires > now);
+    // One malformed cookie must not block the rest.
+    for (const cookie of live) {
+        await context.addCookies([cookie]).catch(() => { });
+    }
+    log("DEBUG", `Restored ${live.length} sign-in cookies`);
+}
+function safeUrl(value) {
+    try {
+        return value ? new URL(value) : null;
+    }
+    catch {
+        return null;
+    }
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+//# sourceMappingURL=login.js.map

package/build/auth/session-store.js

@@ -0,0 +1,46 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writeFileAtomic } from "../utils/atomic-write.js";
+import { sessionPath } from "../utils/paths.js";
+import { log } from "../utils/logger.js";
+export class SessionStore {
+    file;
+    constructor(file = sessionPath()) {
+        this.file = file;
+    }
+    async load() {
+        try {
+            const data = JSON.parse(await fs.promises.readFile(this.file, "utf8"));
+            return typeof data?.accessToken === "string" ? data : null;
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                log("WARN", "Ignoring unreadable session file", error);
+            return null;
+        }
+    }
+    async save(token) {
+        await fs.promises.mkdir(path.dirname(this.file), { recursive: true, mode: 0o700 });
+        await writeFileAtomic(this.file, JSON.stringify(token), { mode: 0o600 });
+    }
+    async clear() {
+        await fs.promises.rm(this.file, { force: true });
+    }
+    async saveIfCurrent(token, expected) {
+        if (!same(await this.load(), expected))
+            return false;
+        await this.save(token);
+        return true;
+    }
+    async clearIfCurrent(expected) {
+        if (!same(await this.load(), expected))
+            return false;
+        await this.clear();
+        return true;
+    }
+}
+function same(a, b) {
+    return !!a && a.accessToken === b.accessToken && a.capturedAt === b.capturedAt &&
+        a.cookieHeader === b.cookieHeader && a.csrfToken === b.csrfToken && a.tenantOrigin === b.tenantOrigin;
+}
+//# sourceMappingURL=session-store.js.map

package/build/auth/token-manager.js

@@ -0,0 +1,150 @@
+import { SessionStore } from "./session-store.js";
+import { mintAccessToken } from "./token-mint.js";
+import { log } from "../utils/logger.js";
+import { TokenRefreshError } from "../api/errors.js";
+const REFRESH_BUFFER_MS = 5 * 60 * 1000; // 5 minutes
+const DEFAULT_TOKEN_TTL_SECONDS = 3600;
+export class TokenManager {
+    cachedToken = null;
+    sessionStore;
+    baseUrl;
+    tokenTtl;
+    mint;
+    mintInFlight = null;
+    rejectedAccessToken = null;
+    constructor(options = {}) {
+        this.sessionStore = options.sessionStore ?? new SessionStore(options.sessionFile);
+        this.baseUrl = options.baseUrl ? new URL(options.baseUrl).origin : undefined;
+        this.tokenTtl = options.tokenTtl ?? DEFAULT_TOKEN_TTL_SECONDS;
+        this.mint = options.mint ?? mintAccessToken;
+    }
+    async getToken(rejectedAccessToken) {
+        if (rejectedAccessToken)
+            this.rejectedAccessToken = rejectedAccessToken;
+        // Check memory cache first
+        if (this.cachedToken && this.isUsable(this.cachedToken)) {
+            log("DEBUG", "Returning cached token");
+            return this.cachedToken;
+        }
+        // Try loading from disk
+        const storedToken = await this.sessionStore.load();
+        if (storedToken && this.isUsable(storedToken)) {
+            log("DEBUG", "Loaded valid token from session store");
+            this.cachedToken = storedToken;
+            return storedToken;
+        }
+        const mintable = this.pickMintable(storedToken);
+        if (mintable) {
+            const minted = await this.mintFromSession(mintable);
+            if (minted)
+                return minted;
+        }
+        log("DEBUG", "No valid token available");
+        return null;
+    }
+    pickMintable(candidate) {
+        return this.baseUrl && candidate && this.matchesTenant(candidate) && candidate.cookieHeader && candidate.csrfToken ? candidate : null;
+    }
+    async mintFromSession(stale) {
+        if (this.mintInFlight) {
+            log("DEBUG", "Joining the in-flight token mint");
+            return this.mintInFlight;
+        }
+        const inFlight = this.runMint(stale).finally(() => {
+            this.mintInFlight = null;
+        });
+        this.mintInFlight = inFlight;
+        return inFlight;
+    }
+    async runMint(stale) {
+        log("DEBUG", "Trying to mint an access token from the session cookie");
+        let result;
+        try {
+            result = await this.mint({
+                baseUrl: this.baseUrl,
+                cookieHeader: stale.cookieHeader,
+                csrfToken: stale.csrfToken,
+            });
+        }
+        catch (error) {
+            throw new TokenRefreshError("token service request failed", error instanceof Error ? error : undefined);
+        }
+        // The auth CLI or another MCP process can finish a login while HTTP minting
+        // is in flight. Its newer session wins over either result of this request.
+        const current = await this.sessionStore.load();
+        if (current && !this.sameToken(current, stale)) {
+            this.cachedToken = current;
+            if (this.isUsable(current))
+                return current;
+            throw new TokenRefreshError("saved authentication changed during refresh");
+        }
+        if (result.ok) {
+            const now = Date.now();
+            const token = {
+                accessToken: result.accessToken,
+                tenantOrigin: this.baseUrl,
+                capturedAt: now,
+                expiresAt: now + this.tokenTtl * 1000,
+                source: "browser",
+                cookieHeader: stale.cookieHeader,
+                csrfToken: stale.csrfToken,
+            };
+            if (!await this.sessionStore.saveIfCurrent(token, stale))
+                return this.afterConcurrentChange();
+            this.cachedToken = token;
+            this.rejectedAccessToken = null;
+            log("INFO", "Minted a fresh access token from the session cookie");
+            return token;
+        }
+        if (result.reason === "sessionExpired") {
+            log("INFO", "The session cookie has expired, a browser login is needed");
+            if (!await this.sessionStore.clearIfCurrent(stale))
+                return this.afterConcurrentChange();
+            this.cachedToken = null;
+            return null;
+        }
+        throw new TokenRefreshError(result.detail ?? "unexpected token service response");
+    }
+    async setToken(token) {
+        await this.sessionStore.save(token);
+        this.cachedToken = token;
+        this.rejectedAccessToken = null;
+        log("DEBUG", "Token cached and persisted");
+    }
+    async clearToken() {
+        this.cachedToken = null;
+        await this.sessionStore.clear();
+        log("DEBUG", "Token cleared from memory and disk");
+    }
+    isUsable(token) {
+        return this.matchesTenant(token) && token.accessToken !== this.rejectedAccessToken && this.isValid(token);
+    }
+    matchesTenant(token) {
+        return this.baseUrl === undefined || token.tenantOrigin === this.baseUrl;
+    }
+    sameToken(a, b) {
+        return a.accessToken === b.accessToken && a.capturedAt === b.capturedAt &&
+            a.cookieHeader === b.cookieHeader && a.csrfToken === b.csrfToken && a.tenantOrigin === b.tenantOrigin;
+    }
+    async afterConcurrentChange() {
+        this.cachedToken = await this.sessionStore.load();
+        if (this.cachedToken && this.isUsable(this.cachedToken))
+            return this.cachedToken;
+        throw new TokenRefreshError("saved authentication changed during refresh");
+    }
+    isValid(token) {
+        const now = Date.now();
+        const timeUntilExpiry = token.expiresAt - now;
+        // Token must expire more than REFRESH_BUFFER_MS in the future
+        const valid = timeUntilExpiry > REFRESH_BUFFER_MS;
+        if (!valid) {
+            log("DEBUG", `Token invalid: expires in ${Math.round(timeUntilExpiry / 1000)}s (buffer: ${REFRESH_BUFFER_MS / 1000}s)`);
+        }
+        return valid;
+    }
+    async needsRefresh() {
+        const token = await this.getToken();
+        return token === null;
+    }
+}
+//# sourceMappingURL=token-manager.js.map