orizu 0.1.6 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "private": false,
   "type": "module",
   "bin": {

package/src/credentials.ts

@@ -13,7 +13,12 @@ import {
 import { join } from 'path'
 import { homedir } from 'os'
 import { randomBytes } from 'crypto'
-import { ServerCredentials, StoredCredentialsV1, StoredCredentialsV2 } from './types.js'
+import {
+  ServerCredentials,
+  StoredCredentialsV1,
+  StoredCredentialsV2,
+  StoredCredentialsV3,
+} from './types.js'
 
 function getConfigDir(): string {
   if (process.env.ORIZU_CONFIG_DIR) {
@@ -35,6 +40,15 @@ function isStoredCredentialsV2(value: unknown): value is StoredCredentialsV2 {
   return typed.version === 2 && !!typed.servers && typeof typed.servers === 'object'
 }
 
+function isStoredCredentialsV3(value: unknown): value is StoredCredentialsV3 {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+
+  const typed = value as Partial<StoredCredentialsV3>
+  return typed.version === 3 && !!typed.servers && typeof typed.servers === 'object'
+}
+
 function isStoredCredentialsV1(value: unknown): value is StoredCredentialsV1 {
   if (!value || typeof value !== 'object') {
     return false
@@ -63,7 +77,7 @@ function migrateToV2(stored: StoredCredentialsV1): StoredCredentialsV2 {
   }
 }
 
-function writeCredentials(config: StoredCredentialsV2) {
+function writeCredentials(config: StoredCredentialsV2 | StoredCredentialsV3) {
   const dir = getConfigDir()
   mkdirSync(dir, { recursive: true, mode: 0o700 })
   chmodSync(dir, 0o700)
@@ -98,15 +112,15 @@ function writeCredentials(config: StoredCredentialsV2) {
   chmodSync(path, 0o600)
 }
 
-function createEmptyCredentialsConfig(): StoredCredentialsV2 {
+function createEmptyCredentialsConfig(): StoredCredentialsV3 {
   return {
-    version: 2 as const,
+    version: 3 as const,
     activeBaseUrl: null,
     servers: {},
   }
 }
 
-function loadCredentialsConfigForWrite(): StoredCredentialsV2 {
+function loadCredentialsConfigForWrite(): StoredCredentialsV2 | StoredCredentialsV3 {
   try {
     return loadCredentialsConfig() || createEmptyCredentialsConfig()
   } catch {
@@ -114,7 +128,7 @@ function loadCredentialsConfigForWrite(): StoredCredentialsV2 {
   }
 }
 
-export function loadCredentialsConfig(): StoredCredentialsV2 | null {
+export function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null {
   const path = getCredentialsPath()
   if (!existsSync(path)) {
     return null
@@ -130,6 +144,10 @@ export function loadCredentialsConfig(): StoredCredentialsV2 | null {
     return null
   }
 
+  if (isStoredCredentialsV3(parsed)) {
+    return parsed
+  }
+
   if (isStoredCredentialsV2(parsed)) {
     return parsed
   }
@@ -156,7 +174,14 @@ export function getServerCredentials(baseUrl: string): ServerCredentials | null
 }
 
 export function saveServerCredentials(baseUrl: string, credentials: ServerCredentials) {
-  const config = loadCredentialsConfigForWrite()
+  const loaded = loadCredentialsConfigForWrite()
+  const config: StoredCredentialsV3 = loaded.version === 3
+    ? loaded
+    : {
+      version: 3,
+      activeBaseUrl: loaded.activeBaseUrl,
+      servers: loaded.servers,
+    }
 
   config.servers[baseUrl] = credentials
   config.activeBaseUrl = baseUrl
@@ -164,7 +189,14 @@ export function saveServerCredentials(baseUrl: string, credentials: ServerCreden
 }
 
 export function updateServerCredentials(baseUrl: string, credentials: ServerCredentials) {
-  const config = loadCredentialsConfigForWrite()
+  const loaded = loadCredentialsConfigForWrite()
+  const config: StoredCredentialsV3 = loaded.version === 3
+    ? loaded
+    : {
+      version: 3,
+      activeBaseUrl: loaded.activeBaseUrl,
+      servers: loaded.servers,
+    }
   config.servers[baseUrl] = credentials
   writeCredentials(config)
 }

package/src/http.ts

@@ -1,6 +1,6 @@
 import { getActiveBaseUrl, getServerCredentials, updateServerCredentials } from './credentials.js'
 import { getFlagBaseUrl, GlobalFlags, normalizeBaseUrl } from './global-flags.js'
-import { LoginResponse, ServerCredentials } from './types.js'
+import { LoginResponse, ServerCredentials, SessionServerCredentials } from './types.js'
 
 let runtimeFlags: GlobalFlags = { local: false, server: null }
 
@@ -75,12 +75,24 @@ export function assertSecureTokenTransport(baseUrl: string) {
   )
 }
 
+function isSessionCredentials(credentials: ServerCredentials): credentials is SessionServerCredentials {
+  return 'accessToken' in credentials
+}
+
+function getAuthorizationToken(credentials: ServerCredentials): string {
+  return isSessionCredentials(credentials) ? credentials.accessToken : credentials.apiKey
+}
+
 function isExpired(expiresAt: number): boolean {
   const nowUnix = Math.floor(Date.now() / 1000)
   return expiresAt <= nowUnix + 30
 }
 
 async function refreshCredentials(baseUrl: string, credentials: ServerCredentials): Promise<ServerCredentials> {
+  if (!isSessionCredentials(credentials)) {
+    throw new Error('API key credentials do not refresh. Run `orizu login` again if access fails.')
+  }
+
   assertSecureTokenTransport(baseUrl)
   const response = await fetch(`${baseUrl}/api/cli/auth/refresh`, {
     method: 'POST',
@@ -93,7 +105,12 @@ async function refreshCredentials(baseUrl: string, credentials: ServerCredential
   }
 
   const data = await response.json() as LoginResponse
+  if (!data.accessToken || !data.refreshToken || !data.expiresAt) {
+    throw new Error('Server returned invalid refresh credentials. Run `orizu login` again.')
+  }
+
   const refreshed = {
+    credentialType: 'session' as const,
     accessToken: data.accessToken,
     refreshToken: data.refreshToken,
     expiresAt: data.expiresAt,
@@ -111,7 +128,7 @@ export async function authedFetch(path: string, init: RequestInit = {}) {
   }
 
   let activeCredentials = credentials
-  if (isExpired(activeCredentials.expiresAt)) {
+  if (isSessionCredentials(activeCredentials) && isExpired(activeCredentials.expiresAt)) {
     activeCredentials = await refreshCredentials(baseUrl, activeCredentials)
   }
 
@@ -119,17 +136,17 @@ export async function authedFetch(path: string, init: RequestInit = {}) {
     ...init,
     headers: {
       ...(init.headers || {}),
-      Authorization: `Bearer ${activeCredentials.accessToken}`,
+      Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
     },
   })
 
-  if (response.status === 401) {
+  if (response.status === 401 && isSessionCredentials(activeCredentials)) {
     activeCredentials = await refreshCredentials(baseUrl, activeCredentials)
     response = await fetch(`${baseUrl}${path}`, {
       ...init,
       headers: {
         ...(init.headers || {}),
-        Authorization: `Bearer ${activeCredentials.accessToken}`,
+        Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
       },
     })
   }