livedesk 0.1.396 → 0.1.397

package/bootstrap/hub-auth-handoff.js

@@ -1,5 +1,18 @@
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs';
+import { dirname, join } from 'node:path';
+import {
+  PRODUCTION_SUPABASE_PUBLISHABLE_KEY,
+  PRODUCTION_SUPABASE_URL
+} from '../runtime-core/src/auth-config.js';
+import { fetchAuthResponse } from '../runtime-core/src/auth-http.js';
 import { normalizeRuntimeAuthSession } from '../runtime-core/src/auth-session.js';
 
 const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
@@ -19,33 +32,113 @@ function parseStoredSession(value) {
   }
 }
 
+function readAuthState(authPath) {
+  try {
+    const value = JSON.parse(readFileSync(authPath, 'utf8'));
+    return value && typeof value === 'object' ? value : {};
+  } catch {
+    return {};
+  }
+}
+
+function writePrivateJsonAtomic(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporaryPath = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  try {
+    writeFileSync(temporaryPath, JSON.stringify(value, null, 2), 'utf8');
+    try { chmodSync(temporaryPath, 0o600); } catch { /* Windows profile ACLs apply instead. */ }
+    renameSync(temporaryPath, path);
+    try { chmodSync(path, 0o600); } catch { /* Windows profile ACLs apply instead. */ }
+  } catch (error) {
+    try { rmSync(temporaryPath, { force: true }); } catch { /* best effort cleanup */ }
+    throw error;
+  }
+}
+
+function sessionIsFresh(session, nowSeconds) {
+  const expiresAt = Number(session?.expires_at || 0);
+  return Number.isFinite(expiresAt)
+    && expiresAt - Number(nowSeconds || 0) > MINIMUM_SESSION_LIFETIME_SECONDS;
+}
+
+function resolveSupabaseAuthConfig(env = process.env) {
+  const supabaseUrl = String(
+    env.LIVEDESK_RUNTIME_SUPABASE_URL
+    || env.LIVEDESK_SUPABASE_URL
+    || PRODUCTION_SUPABASE_URL
+  ).trim().replace(/\/+$/, '');
+  const publishableKey = String(
+    env.LIVEDESK_RUNTIME_SUPABASE_PUBLISHABLE_KEY
+    || env.LIVEDESK_SUPABASE_PUBLISHABLE_KEY
+    || PRODUCTION_SUPABASE_PUBLISHABLE_KEY
+  ).trim();
+  return { supabaseUrl, publishableKey };
+}
+
 /**
  * Contract:
  * - Reads only the unified local Client auth store.
- * - Returns only a refreshable access session that will remain valid long
- *   enough for the new local Hub to verify it.
+ * - Returns only a refreshable session; transfer refreshes stale access tokens.
  * - Never logs or serializes token values outside the loopback handoff.
  */
-export async function readSavedClientSessionForHub(
+export async function readSavedClientSessionForHub(stateDir) {
+  const authState = readAuthState(join(stateDir, 'auth.json'));
+  const candidate = parseStoredSession(authState?.[CLIENT_AUTH_STORAGE_KEY]);
+  const normalized = normalizeRuntimeAuthSession(candidate, { requireRefreshToken: true });
+  return normalized.ok ? normalized.session : null;
+}
+
+async function refreshSavedClientSessionForHub(
+  session,
   stateDir,
-  nowSeconds = Math.floor(Date.now() / 1000)
+  fetchImpl,
+  nowSeconds
 ) {
-  try {
-    const authState = JSON.parse(await readFile(join(stateDir, 'auth.json'), 'utf8'));
-    const candidate = parseStoredSession(authState?.[CLIENT_AUTH_STORAGE_KEY]);
-    const normalized = normalizeRuntimeAuthSession(candidate, { requireRefreshToken: true });
-    if (!normalized.ok) {
-      return null;
-    }
-    const expiresAt = Number(normalized.session.expires_at || 0);
-    if (!Number.isFinite(expiresAt)
-      || expiresAt - Number(nowSeconds || 0) <= MINIMUM_SESSION_LIFETIME_SECONDS) {
-      return null;
-    }
-    return normalized.session;
-  } catch {
+  const { supabaseUrl, publishableKey } = resolveSupabaseAuthConfig();
+  const response = await fetchAuthResponse(fetchImpl, `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+    method: 'POST',
+    headers: {
+      apikey: publishableKey,
+      'Content-Type': 'application/json',
+      Accept: 'application/json'
+    },
+    body: JSON.stringify({ refresh_token: session.refresh_token })
+  }, 5_000);
+  const data = await response.json().catch(() => null);
+  if (!response.ok) {
+    throw new Error(`saved-client-session-refresh-failed:${response.status}`);
+  }
+  const expiresAt = Number(data?.expires_at || 0)
+    || (Number(data?.expires_in || 0) > 0
+      ? Number(nowSeconds || 0) + Number(data.expires_in)
+      : 0);
+  const normalized = normalizeRuntimeAuthSession({
+    ...data,
+    expires_at: expiresAt,
+    refresh_token: data?.refresh_token || session.refresh_token,
+    user: data?.user || session.user
+  }, { requireRefreshToken: true });
+  if (!normalized.ok || !sessionIsFresh(normalized.session, nowSeconds)) {
+    throw new Error('saved-client-session-refresh-invalid');
+  }
+
+  const authPath = join(stateDir, 'auth.json');
+  const authState = readAuthState(authPath);
+  authState[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
+  writePrivateJsonAtomic(authPath, authState);
+  return normalized.session;
+}
+
+async function resolveTransferSession(stateDir, fetchImpl, nowSeconds) {
+  const saved = await readSavedClientSessionForHub(stateDir);
+  if (!saved) {
     return null;
   }
+  if (sessionIsFresh(saved, nowSeconds)) {
+    return { session: saved, refreshed: false };
+  }
+  const refreshed = await refreshSavedClientSessionForHub(saved, stateDir, fetchImpl, nowSeconds);
+  return { session: refreshed, refreshed: true };
 }
 
 export async function transferSavedClientSessionToHub(
@@ -54,25 +147,23 @@ export async function transferSavedClientSessionToHub(
   fetchImpl = fetch,
   nowSeconds = Math.floor(Date.now() / 1000)
 ) {
-  const session = await readSavedClientSessionForHub(stateDir, nowSeconds);
-  if (!session) {
-    return { ok: false, skipped: true, reason: 'no-valid-saved-client-session' };
-  }
-
   try {
-    const response = await fetchImpl(new URL('/api/auth/session', baseUrl), {
+    const resolved = await resolveTransferSession(stateDir, fetchImpl, nowSeconds);
+    if (!resolved) {
+      return { ok: false, skipped: true, reason: 'no-refreshable-saved-client-session' };
+    }
+    const response = await fetchAuthResponse(fetchImpl, new URL('/api/auth/session', baseUrl), {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
         Accept: 'application/json'
       },
       body: JSON.stringify({
-        accessToken: session.access_token,
-        refreshToken: session.refresh_token,
-        expiresAt: session.expires_at
-      }),
-      signal: AbortSignal.timeout(5_000)
-    });
+        accessToken: resolved.session.access_token,
+        refreshToken: resolved.session.refresh_token,
+        expiresAt: resolved.session.expires_at
+      })
+    }, 5_000);
     const data = await response.json().catch(() => null);
     if (!response.ok || data?.authenticated !== true) {
       return {
@@ -85,6 +176,7 @@ export async function transferSavedClientSessionToHub(
       ok: true,
       skipped: false,
       authenticated: true,
+      refreshed: resolved.refreshed,
       hostTargetOk: data?.hostTarget?.ok !== false
     };
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "livedesk",
-  "version": "0.1.396",
+  "version": "0.1.397",
   "livedeskClientVersion": "0.1.173",
   "buildFlavor": "production",
   "description": "LiveDesk Hub and client launcher",