openyida 2026.10.13 → 2026.10.14

package/lib/auth/token-store.js

@@ -293,6 +293,7 @@ function normalizeTokenSession(session = {}) {
     auth_source: session.auth_source || session.authSource,
     auth_store: session.auth_store || session.authStore,
     auth_profile: session.auth_profile || session.authProfile,
+    auth_generation: session.auth_generation,
     persistence_scope: session.persistence_scope || session.persistenceScope,
     runtime_binding_id: session.runtime_binding_id || session.runtimeBindingId,
     user_auth_store_writable: typeof session.user_auth_store_writable === 'boolean'
@@ -505,6 +506,12 @@ function deleteUserAuthProfile(authProfile, options = {}) {
   }
 
   let deleted = false;
+  // Persist invalidation before removal so an in-flight refresh cannot
+  // resurrect a deleted profile, including a later login with the same ID.
+  writeJsonFileAtomic(path.join(resolveUserAuthDir(options), 'revocations', `${normalizedAuthProfile}.json`), {
+    generation: crypto.randomBytes(16).toString('hex'),
+    revoked_at: new Date().toISOString(),
+  });
   try {
     const profileFile = getUserProfileFilePath(normalizedAuthProfile, options);
     if (profileFile && fs.existsSync(profileFile)) {
@@ -567,6 +574,7 @@ function saveUserTokenSession(session, options = {}) {
   const profileSession = normalizeTokenSession({
     ...normalized,
     auth_profile: authProfile,
+    auth_generation: crypto.randomBytes(16).toString('hex'),
     auth_source: 'user_profile',
     auth_store: 'user',
     persistence_scope: 'user',
@@ -581,11 +589,11 @@ function saveUserTokenSession(session, options = {}) {
   writeJsonFileAtomic(getUserProfileFilePath(authProfile, options), payload);
   let pointerWarning;
   try {
-    saveAuthProfilePointer(profileSession, options);
+    if (options.persistProfilePointer !== false) {saveAuthProfilePointer(profileSession, options);}
   } catch (error) {
     pointerWarning = `project_auth_pointer_unavailable: ${error.message}`;
   }
-  clearProjectLegacyTokenSession(options);
+  if (options.persistProfilePointer !== false) {clearProjectLegacyTokenSession(options);}
   if (pointerWarning) {
     return attachAuthStoreMetadata(profileSession, {
       warning: pointerWarning,
@@ -958,6 +966,21 @@ function loadTokenSession(options = {}) {
   return resolveTokenSession(options).session;
 }
 
+function authProfileRevision(authProfile, options = {}) {
+  const session = loadUserProfileFile(authProfile, options);
+  if (!session) {return null;}
+  let revocation;
+  try {
+    revocation = fs.readFileSync(path.join(resolveUserAuthDir(options), 'revocations', `${sanitizeProfileName(authProfile)}.json`), 'utf8');
+  } catch (error) {
+    if (error.code !== 'ENOENT') {throw error;}
+    revocation = '';
+  }
+  return crypto.createHash('sha256').update(JSON.stringify([
+    session.auth_generation, session.access_token, session.refresh_token, revocation,
+  ])).digest('hex');
+}
+
 function clearTokenSession(options = {}) {
   clearAuthProfilePointer(options);
   clearProjectLegacyTokenSession(options);
@@ -986,6 +1009,7 @@ function maskToken(token) {
 
 module.exports = {
   getTokenFilePath,
+  authProfileRevision,
   getAuthProfilePointerFilePath,
   getUserProfileFilePath,
   resolveUserAuthDir,