livedesk 0.1.541 → 0.1.543

package/electron/auth-session-owner.mjs

@@ -0,0 +1,40 @@
+export const DESKTOP_AUTH_REFRESH_SKEW_SECONDS = 5 * 60;
+export const DESKTOP_AUTH_RETRY_MS = 15_000;
+export const DESKTOP_AUTH_MINIMUM_TIMER_MS = 30_000;
+
+export function desktopSessionNeedsRefresh(
+  session,
+  nowSeconds = Math.floor(Date.now() / 1000),
+  skewSeconds = DESKTOP_AUTH_REFRESH_SKEW_SECONDS
+) {
+  const expiresAt = Number(session?.expires_at || 0);
+  return !Number.isFinite(expiresAt)
+    || expiresAt <= Number(nowSeconds || 0) + Math.max(0, Number(skewSeconds || 0));
+}
+
+export function desktopSessionIsUsable(session, nowSeconds = Math.floor(Date.now() / 1000)) {
+  const expiresAt = Number(session?.expires_at || 0);
+  return Boolean(session?.access_token && session?.refresh_token)
+    && Number.isFinite(expiresAt)
+    && expiresAt > Number(nowSeconds || 0) + 5;
+}
+
+export function desktopSessionRefreshDelayMs(
+  session,
+  nowMs = Date.now(),
+  skewSeconds = DESKTOP_AUTH_REFRESH_SKEW_SECONDS
+) {
+  const expiresAtMs = Number(session?.expires_at || 0) * 1000;
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= 0) {
+    return DESKTOP_AUTH_RETRY_MS;
+  }
+  return Math.max(
+    DESKTOP_AUTH_MINIMUM_TIMER_MS,
+    expiresAtMs - Number(nowMs || 0) - Math.max(0, Number(skewSeconds || 0)) * 1000
+  );
+}
+
+export function isPermanentDesktopAuthRefreshFailure(error) {
+  const status = Number(error?.authStatus || 0);
+  return status === 400 || status === 401 || status === 403;
+}

package/electron/main.mjs

@@ -1,4 +1,4 @@
-import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, nativeImage, safeStorage, shell, Tray } from 'electron';
+import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, nativeImage, powerMonitor, safeStorage, shell, Tray } from 'electron';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
@@ -6,7 +6,14 @@ import { spawn } from 'node:child_process';
 import { createProductUpdateManager } from './update-manager.mjs';
 import { createPkceAuthorizationUrl, exchangePkceCode, fetchSupabaseUser, parsePkceCallbackUrl, refreshSupabaseSession } from './oauth-pkce.mjs';
 import { getRuntimeAuthEnvironment, resolveDesktopAuthConfig, resolveDesktopBuildFlavor } from './auth-config.mjs';
-import { createBoundedDesktopLogger } from './bounded-desktop-log.mjs';
+import { createBoundedDesktopLogger } from './bounded-desktop-log.mjs';
+import {
+  DESKTOP_AUTH_RETRY_MS,
+  desktopSessionIsUsable,
+  desktopSessionNeedsRefresh,
+  desktopSessionRefreshDelayMs,
+  isPermanentDesktopAuthRefreshFailure
+} from './auth-session-owner.mjs';
 import { resolveDeviceRole } from '../bootstrap/device-role.js';
 import {
   registerOwnedWindowsChild,
@@ -92,8 +99,11 @@ let quitSequenceStarted = false;
 let updateInstallSequenceStarted = false;
 let productUpdates = null;
 let pendingOAuth = null;
-let pendingProtocolUrl = '';
-let runtimeLogoutPromise = null;
+let pendingProtocolUrl = '';
+let runtimeLogoutPromise = null;
+let desktopAuthRefreshTimer = null;
+let desktopSessionRestorePromise = null;
+let lastDesktopResumeRecoveryAt = 0;
 const FALLBACK_ICON_DATA_URL = `data:image/svg+xml;charset=utf-8,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32" fill="none"><rect x="1" y="1" width="30" height="30" rx="7" fill="#111827"/><g transform="translate(5 5) scale(.785714)"><rect x="2.5" y="4" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".42"/><path d="M7 16v1.5h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".42"/><rect x="10.5" y="2.5" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".62"/><path d="M15 14.5V16h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".62"/><rect x="6.5" y="8.5" width="15" height="10" rx="1.7" fill="#F8FAFC" fill-opacity=".12" stroke="#F8FAFC" stroke-width="1.9"/><path d="M12 21v1.5H9.5M16 21v1.5h2.5M9.5 22.5h9" stroke="#F8FAFC" stroke-width="1.9" stroke-linecap="round"/></g></svg>')}`;
 const desktopLogger = createBoundedDesktopLogger({ logPath });
 
@@ -179,9 +189,10 @@ function readEncryptedSession() {
   }
 }
 
-function clearEncryptedSession() {
-  try { rmSync(authSessionPath, { force: true }); } catch { /* best effort */ }
-}
+function clearEncryptedSession() {
+  clearDesktopAuthRefreshTimer();
+  try { rmSync(authSessionPath, { force: true }); } catch { /* best effort */ }
+}
 
 function migrateLegacyPlaintextSession() {
   if (!safeStorage.isEncryptionAvailable()) return;
@@ -608,7 +619,7 @@ async function clearRuntimeSessionWithRecovery() {
   }
 }
 
-async function validateSessionWithSupabase(session) {
+async function validateSessionWithSupabase(session) {
   const normalized = normalizeSession(session);
   if (!normalized) throw new Error('oauth-session-invalid');
   const user = await fetchSupabaseUser({
@@ -619,35 +630,97 @@ async function validateSessionWithSupabase(session) {
   if (normalized.user?.id && String(normalized.user.id) !== String(user.id)) {
     throw new Error('oauth-session-user-mismatch');
   }
-  return { ...normalized, user };
-}
-
-async function restoreEncryptedSession({ syncRuntime = true } = {}) {
-  let session = readEncryptedSession();
-  if (!session) return null;
-  if (session.expires_at && session.expires_at <= Math.floor(Date.now() / 1000) + 60) {
-    try {
-      session = await refreshSupabaseSession({
-        supabaseUrl: SUPABASE_URL,
-        publishableKey: SUPABASE_PUBLISHABLE_KEY,
-        refreshToken: session.refresh_token
-      });
-      saveEncryptedSession(session);
-    } catch (error) {
-      log(`secure auth session refresh failed: ${error?.message || error}`);
-      clearEncryptedSession();
-      return null;
-    }
-  }
-  if (!syncRuntime) return session;
-  try {
-    await syncSessionToRuntime(session);
-    return session;
-  } catch (error) {
-    log(`secure auth session runtime sync failed: ${error?.message || error}`);
-    return null;
-  }
-}
+  return { ...normalized, user };
+}
+
+function clearDesktopAuthRefreshTimer() {
+  if (!desktopAuthRefreshTimer) return;
+  clearTimeout(desktopAuthRefreshTimer);
+  desktopAuthRefreshTimer = null;
+}
+
+function scheduleDesktopAuthRefresh(session, delayMs = desktopSessionRefreshDelayMs(session)) {
+  clearDesktopAuthRefreshTimer();
+  if (!session || isQuitting) return;
+  desktopAuthRefreshTimer = setTimeout(() => {
+    desktopAuthRefreshTimer = null;
+    void restoreEncryptedSession({ syncRuntime: true }).then(restored => {
+      if (desktopSessionIsUsable(restored)) {
+        sendAuthEvent({ ok: true, session: restored, restored: true });
+      }
+    }).catch(error => {
+      log(`scheduled secure auth session recovery failed: ${error?.message || error}`);
+    });
+  }, Math.max(1_000, Number(delayMs) || DESKTOP_AUTH_RETRY_MS));
+  desktopAuthRefreshTimer.unref?.();
+}
+
+async function restoreEncryptedSessionOwned({ syncRuntime = true } = {}) {
+  let session = readEncryptedSession();
+  if (!session) return null;
+  if (desktopSessionNeedsRefresh(session)) {
+    try {
+      const refreshed = await refreshSupabaseSession({
+        supabaseUrl: SUPABASE_URL,
+        publishableKey: SUPABASE_PUBLISHABLE_KEY,
+        refreshToken: session.refresh_token
+      });
+      session = {
+        ...session,
+        ...refreshed,
+        user: refreshed?.user && typeof refreshed.user === 'object' ? refreshed.user : session.user
+      };
+      saveEncryptedSession(session);
+    } catch (error) {
+      log(`secure auth session refresh failed: ${error?.message || error}`);
+      if (isPermanentDesktopAuthRefreshFailure(error)) {
+        clearEncryptedSession();
+        sendAuthEvent({ ok: true, signedOut: true, reason: 'refresh-rejected' });
+        return null;
+      }
+      // A sleeping computer commonly resumes before DNS and Wi-Fi. Keep the
+      // encrypted refresh token and retry instead of turning an outage into a
+      // user-visible sign-out.
+      scheduleDesktopAuthRefresh(session, DESKTOP_AUTH_RETRY_MS);
+      return session;
+    }
+  }
+  if (syncRuntime) {
+    try {
+      await syncSessionToRuntime(session);
+    } catch (error) {
+      log(`secure auth session runtime sync failed: ${error?.message || error}`);
+      scheduleDesktopAuthRefresh(session, DESKTOP_AUTH_RETRY_MS);
+      return session;
+    }
+  }
+  scheduleDesktopAuthRefresh(session);
+  return session;
+}
+
+async function restoreEncryptedSession(options = {}) {
+  if (desktopSessionRestorePromise) return desktopSessionRestorePromise;
+  const operation = restoreEncryptedSessionOwned(options);
+  desktopSessionRestorePromise = operation;
+  try {
+    return await operation;
+  } finally {
+    if (desktopSessionRestorePromise === operation) desktopSessionRestorePromise = null;
+  }
+}
+
+function requestDesktopResumeAuthRecovery(source) {
+  const now = Date.now();
+  if (now - lastDesktopResumeRecoveryAt < 1_500) return;
+  lastDesktopResumeRecoveryAt = now;
+  void restoreEncryptedSession({ syncRuntime: true }).then(session => {
+    if (!desktopSessionIsUsable(session)) return;
+    log(`secure auth session recovered after ${source}`);
+    sendAuthEvent({ ok: true, session, restored: true, resumed: true });
+  }).catch(error => {
+    log(`secure auth session ${source} recovery failed: ${error?.message || error}`);
+  });
+}
 
 async function resolveStartupRole(session) {
   try {
@@ -739,9 +812,10 @@ async function handleProtocolUrl(rawUrl) {
       code,
       codeVerifier: request.codeVerifier
     }));
-    pendingOAuth = null;
-    await syncSessionToRuntime(session);
-    sendAuthEvent({ ok: true, session });
+    pendingOAuth = null;
+    await syncSessionToRuntime(session);
+    scheduleDesktopAuthRefresh(session);
+    sendAuthEvent({ ok: true, session });
     showWindow();
   } catch (error) {
     const message = String(error?.message || error);
@@ -792,11 +866,14 @@ function createMainWindow() {
     void shell.openExternal(url);
     return { action: 'deny' };
   });
-  mainWindow.loadURL(LOCAL_RUNTIME_URL);
-  mainWindow.webContents.on('did-finish-load', () => {
-    const session = readEncryptedSession();
-    if (session) sendAuthEvent({ ok: true, session, restored: true });
-  });
+  mainWindow.loadURL(LOCAL_RUNTIME_URL);
+  mainWindow.webContents.on('did-finish-load', () => {
+    void restoreEncryptedSession({ syncRuntime: true }).then(session => {
+      if (desktopSessionIsUsable(session)) sendAuthEvent({ ok: true, session, restored: true });
+    }).catch(error => {
+      log(`secure auth session window restore failed: ${error?.message || error}`);
+    });
+  });
   mainWindow.once('ready-to-show', () => { updateTray('Running'); if (process.env.LIVEDESK_E2E_HEADLESS !== '1') showWindow(); });
   mainWindow.on('close', event => {
     if (!isQuitting) {
@@ -841,12 +918,13 @@ function registerIpc() {
     }
   });
   handle('auth:sign-in-google', () => beginGoogleAuth());
-  handle('auth:get-session', () => readEncryptedSession());
-  handle('auth:persist-session', async session => {
-    if (session) {
-      try {
-        saveEncryptedSession(await validateSessionWithSupabase(session));
-        return { ok: true };
+  handle('auth:get-session', () => restoreEncryptedSession({ syncRuntime: true }));
+  handle('auth:persist-session', async session => {
+    if (session) {
+      try {
+        const validated = saveEncryptedSession(await validateSessionWithSupabase(session));
+        scheduleDesktopAuthRefresh(validated);
+        return { ok: true };
       } catch (error) {
         const message = String(error?.message || error);
         log(`renderer auth session validation failed: ${message}`);
@@ -934,16 +1012,18 @@ if (!app.requestSingleInstanceLock()) {
     app.setAsDefaultProtocolClient('livedesk');
     removeLegacyStartupEntries();
     migrateLegacyPlaintextSession();
-    productUpdates = createProductUpdateManager({
+    productUpdates = createProductUpdateManager({
       app,
       onStatus: status => {
         if (status.state === 'available') updateTray(`Update ${status.availableVersion} available`);
       },
       beforeInstall: prepareRuntimeForUpdateInstall,
       onInstallError: recoverRuntimeAfterUpdateInstallError
-    });
-    registerIpc();
-    const startupSession = await restoreEncryptedSession({ syncRuntime: false });
+    });
+    registerIpc();
+    powerMonitor.on('resume', () => requestDesktopResumeAuthRecovery('system-resume'));
+    powerMonitor.on('unlock-screen', () => requestDesktopResumeAuthRecovery('screen-unlock'));
+    const startupSession = await restoreEncryptedSession({ syncRuntime: false });
     const forceBootstrapForE2e = DESKTOP_BUILD_FLAVOR === 'e2e' && process.env.LIVEDESK_E2E_ROLE_BOOTSTRAP === '1';
     const startupRole = forceBootstrapForE2e ? null : await resolveStartupRole(startupSession);
     startRuntime(startupRole || {});

package/electron/oauth-pkce.mjs

@@ -115,7 +115,7 @@ export async function exchangePkceCode({
   return payload;
 }
 
-export async function refreshSupabaseSession({
+export async function refreshSupabaseSession({
   supabaseUrl,
   publishableKey,
   refreshToken,
@@ -135,9 +135,12 @@ export async function refreshSupabaseSession({
     },
     body: JSON.stringify({ refresh_token: refreshToken })
   }, timeoutMs);
-  const payload = await response.json().catch(() => ({}));
-  if (!response.ok || !payload?.access_token || !payload?.refresh_token) {
-    throw new Error(String(payload?.msg || payload?.error_description || payload?.error || `oauth-refresh-failed:${response.status}`));
-  }
-  return payload;
-}
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok || !payload?.access_token || !payload?.refresh_token) {
+    const error = new Error(String(payload?.msg || payload?.error_description || payload?.error || `oauth-refresh-failed:${response.status}`));
+    error.authStatus = response.status;
+    error.authCode = String(payload?.error_code || payload?.code || payload?.error || '');
+    throw error;
+  }
+  return payload;
+}

package/hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.45",
+  "version": "0.1.46",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/hub/src/server.js

@@ -513,11 +513,19 @@ async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
-  if (accessToken && !expiresSoon) {
-    return accessToken;
-  }
-
-  const refreshToken = String(runtimeRefreshToken || '').trim();
+  if (accessToken && !expiresSoon) {
+    return accessToken;
+  }
+
+  // The packaged Electron main process owns the encrypted refresh token and
+  // proactively sends each rotation to this child runtime. A second refresh
+  // owner here could consume the one-time token first and make the desktop
+  // shell appear signed out after sleep.
+  if (desktopMainAuthConfig) {
+    return accessToken;
+  }
+
+  const refreshToken = String(runtimeRefreshToken || '').trim();
   if (!refreshToken) {
     return accessToken;
   }
@@ -621,9 +629,9 @@ async function queryAuthoritativeRuntimeRole() {
     },
     SUPABASE_AUTH_TIMEOUT_MS
   );
-  if (response.status === 401 || response.status === 403) {
-    clearRuntimeSession();
-    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    if (!desktopMainAuthConfig) clearRuntimeSession();
+    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`hub-role-query-failed:${response.status}`);
@@ -4601,9 +4609,9 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   );
   const data = await response.json().catch(() => null);
   const result = Array.isArray(data) ? data[0] : data;
-  if (response.status === 401 || response.status === 403) {
-    clearRuntimeSession();
-    throw new Error(`${name}-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    if (!desktopMainAuthConfig) clearRuntimeSession();
+    throw new Error(`${name}-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`${name}-failed:${response.status}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "livedesk",
-  "version": "0.1.541",
+  "version": "0.1.543",
   "livedeskClientVersion": "0.1.246",
   "buildFlavor": "production",
   "description": "LiveDesk Hub and client launcher",

package/web/dist/app.webmanifest

@@ -4,7 +4,7 @@
   "short_name": "LiveDesk",
   "description": "Monitor and control your LiveDesk computers from your phone.",
   "lang": "en",
-  "start_url": "/?pwa=0.1.541",
+  "start_url": "/?pwa=0.1.543",
   "scope": "/",
   "display": "standalone",
   "orientation": "any",