slidemind 0.2.3 → 0.3.0

package/src/bridge/config.mjs

@@ -14,13 +14,24 @@
 // The legacy v1 shape ({ backendURL, sessionToken }) is migrated transparently
 // on read, so older installs and the raw-file test writers keep working.
 //
+// A record may additionally carry `msGraphRefreshToken` — the user's own Entra
+// refresh token from `slidemind login` (see graph-auth.mjs). It is a SECOND
+// credential with a different subject: the CLI session is minted by the add-in
+// for whoever clicked Connect CLI, the Graph token belongs to whoever completed
+// the browser sign-in. Written only when present, so a machine that never ran
+// `login` keeps a byte-identical file.
+//
 // Stored under XDG_CONFIG_HOME (config, not cache/state) so it persists and is
 // clearly user-scoped. 0600 — it holds bearer credentials.
 
+import { execFileSync } from "node:child_process";
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { register as registerSecret } from "./secrets.mjs";
+
 export function sessionConfigDir() {
   // An explicitly set XDG_CONFIG_HOME wins on EVERY platform — it's a
   // deliberate override (and how the test suite isolates the store, also on
@@ -60,6 +71,46 @@ export function deriveEnvLabel(backendURL) {
   return host;
 }
 
+// ---------------------------------------------------------------------------
+// How loudly to talk about environments
+// ---------------------------------------------------------------------------
+//
+// The env label exists because a slidemind DEVELOPER pairs local / dev / prod at
+// once. A normal user connects exactly one backend, and for them the label on
+// every line is noise that makes ordinary output read like a debugging session.
+// So it is routing metadata, shown only when it actually disambiguates: more
+// than one backend connected.
+//
+// Deliberately NOT gated: `--json` (agents route on it), `doctor` and `whoami`
+// (reporting environments is their whole job), and any label the user just
+// typed — `--backend prod`, `logout dev` — because suppressing an echo of their
+// own argument is confusing, not quiet.
+//
+// Memoised: `presentations` would otherwise re-read the session file once per
+// printed row. `writeAll` clears it, which covers every mutation (setup, login,
+// logout, use) inside a single process.
+let _sessionCount = null;
+
+export function isMultiEnv() {
+  if (_sessionCount === null) _sessionCount = readSessions().length;
+  return _sessionCount > 1;
+}
+
+/** " [dev]" when more than one backend is connected, "" otherwise. */
+export function envTag(env) {
+  return env && isMultiEnv() ? ` [${env}]` : "";
+}
+
+/**
+ * An in-sentence env mention — `envPhrase("dev", "for")` → " for dev" — or ""
+ * when there is only one environment to mean. Callers word the sentence so it
+ * reads correctly either way.
+ */
+export function envPhrase(env, preposition = "on") {
+  if (!env || !isMultiEnv()) return "";
+  return preposition === "on" ? ` on '${env}'` : ` ${preposition} ${env}`;
+}
+
 function isValidRecord(o) {
   return (
     o &&
@@ -84,6 +135,20 @@ function readRaw() {
   }
 }
 
+// Every credential this file hands out is registered for output scrubbing the
+// moment it is read, so a token spliced into an error message downstream — a
+// server echoing the request back, a response body used as an error detail —
+// renders as an opaque tag instead of the value. Reading the session file is
+// the single door every session token comes through, so this is the one place
+// that has to remember. The `@keychain` marker is a literal, not a secret.
+function registerRecordSecrets(record) {
+  registerSecret(record.sessionToken);
+  if (record.msGraphRefreshToken && record.msGraphRefreshToken !== KEYCHAIN_MARKER) {
+    registerSecret(record.msGraphRefreshToken);
+  }
+  return record;
+}
+
 // All paired sessions as [{ backendURL, sessionToken, label }]. Migrates the v1
 // single-record shape transparently. Returns [] when not paired / unreadable.
 export function readSessions() {
@@ -91,14 +156,18 @@ export function readSessions() {
   if (!obj) return [];
   // v2: { version, sessions: [...], default }
   if (Array.isArray(obj.sessions)) {
-    return obj.sessions.filter(isValidRecord).map((s) => ({
+    return obj.sessions.filter(isValidRecord).map(registerRecordSecrets).map((s) => ({
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: typeof s.label === "string" && s.label ? s.label : deriveEnvLabel(s.backendURL),
+      ...(typeof s.msGraphRefreshToken === "string" && s.msGraphRefreshToken
+        ? { msGraphRefreshToken: s.msGraphRefreshToken }
+        : {}),
     }));
   }
   // v1: { backendURL, sessionToken }
   if (isValidRecord(obj)) {
+    registerRecordSecrets(obj);
     return [
       {
         backendURL: obj.backendURL,
@@ -122,6 +191,7 @@ export function getDefaultBackend() {
 }
 
 function writeAll(sessions, defaultBackend) {
+  _sessionCount = null; // the count just changed — see isMultiEnv()
   fs.mkdirSync(sessionConfigDir(), { recursive: true });
   const payload = {
     version: 2,
@@ -129,6 +199,7 @@ function writeAll(sessions, defaultBackend) {
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: s.label || deriveEnvLabel(s.backendURL),
+      ...(s.msGraphRefreshToken ? { msGraphRefreshToken: s.msGraphRefreshToken } : {}),
     })),
   };
   const def =
@@ -143,6 +214,12 @@ function writeAll(sessions, defaultBackend) {
 
 // Add or replace a session (keyed by backendURL). Becomes the default if none
 // is set yet. Preserves the existing default otherwise.
+//
+// Any stored `msGraphRefreshToken` is deliberately NOT carried over: redeeming
+// a fresh claim can hand this machine to a different identity, and silently
+// pairing that session with the previous user's delegated Graph token would
+// fetch one person's content under another's session. `slidemind login` again
+// is one command; a mismatched identity is not recoverable by the user.
 export function upsertSession({ backendURL, sessionToken, label = null }) {
   if (!backendURL || !sessionToken) {
     throw new Error("upsertSession: backendURL and sessionToken are required");
@@ -200,6 +277,121 @@ export function getSessionFor(backendURL) {
   return readSessions().find((s) => s.backendURL === backendURL) || null;
 }
 
+// --- Graph refresh-token at-rest storage ------------------------------------
+//
+// On macOS the token goes into the login Keychain (encrypted at rest, absent
+// from file backups and accidental config-dir syncs); the session file then
+// carries only the marker below so hasGraphSession stays a file read. Any
+// keychain failure falls back to the plaintext field silently — the 0600 file
+// is the universal path and stays what Linux and Windows use.
+// ponytail: macOS-only at-rest hardening — upgrade path is libsecret on Linux
+// and DPAPI/Credential Manager on Windows, both of which need a dependency.
+//
+// The `security` CLI takes the secret as an argv, which is visible in a process
+// listing for the milliseconds the write takes — to the same user and root,
+// i.e. the same principals who can already read the 0600 fallback file. Judged
+// acceptable against what the keychain buys at rest.
+//
+// Never during tests: `node --test` sets NODE_TEST_CONTEXT, and a test writing
+// into the developer's real login keychain would outlive the test's isolated
+// XDG_CONFIG_HOME. SLIDEMIND_NO_KEYCHAIN is the explicit opt-out.
+const KEYCHAIN_MARKER = "@keychain";
+const KEYCHAIN_SERVICE = "slidemind-msgraph";
+
+function keychainUsable() {
+  return (
+    process.platform === "darwin" &&
+    !process.env.NODE_TEST_CONTEXT &&
+    !process.env.SLIDEMIND_NO_KEYCHAIN
+  );
+}
+
+// Stable per-backend account key. Hashed: keychain account fields end up in
+// `security dump-keychain` output and logs, and the backend URL is exactly the
+// thing user-facing output must never carry.
+function keychainAccount(backendURL) {
+  return crypto.createHash("sha256").update(String(backendURL)).digest("hex").slice(0, 32);
+}
+
+function keychainWrite(backendURL, token) {
+  execFileSync(
+    "security",
+    ["add-generic-password", "-U", "-s", KEYCHAIN_SERVICE, "-a", keychainAccount(backendURL), "-w", token],
+    { stdio: "ignore" },
+  );
+}
+
+function keychainRead(backendURL) {
+  const out = execFileSync(
+    "security",
+    ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", keychainAccount(backendURL), "-w"],
+    { stdio: ["ignore", "pipe", "ignore"] },
+  );
+  const token = out.toString("utf8").trim();
+  return token || null;
+}
+
+function keychainDelete(backendURL) {
+  try {
+    execFileSync(
+      "security",
+      ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", keychainAccount(backendURL)],
+      { stdio: "ignore" },
+    );
+  } catch {
+    /* nothing stored — logout of a file-stored or never-stored token */
+  }
+}
+
+// The user's stored Entra refresh token for one backend, or null. See
+// graph-auth.mjs — nothing else may read it, and it never leaves this machine
+// except as an Authorization on a token refresh.
+export function getGraphRefreshToken(backendURL) {
+  const stored = getSessionFor(backendURL)?.msGraphRefreshToken ?? null;
+  if (stored !== KEYCHAIN_MARKER) return stored;
+  try {
+    // The file held only the marker, so `readSessions` had nothing to register —
+    // the real value first exists here.
+    const fromKeychain = keychainRead(backendURL);
+    registerSecret(fromKeychain);
+    return fromKeychain;
+  } catch {
+    // Marker without a readable keychain item (locked keychain, item removed
+    // by hand): behave as signed out rather than erroring every engine op.
+    return null;
+  }
+}
+
+// Store (or, with a null token, drop) the Graph refresh token for one backend.
+// Every refresh returns a NEW refresh token, so this is called on each rotation.
+// Returns false when that backend is no longer paired — a session removed
+// mid-refresh must not resurrect itself as a token-only record.
+export function setGraphRefreshToken(backendURL, refreshToken) {
+  const sessions = readSessions();
+  const record = sessions.find((s) => s.backendURL === backendURL);
+  if (!record) return false;
+  if (refreshToken) {
+    record.msGraphRefreshToken = refreshToken;
+    if (keychainUsable()) {
+      try {
+        keychainWrite(backendURL, refreshToken);
+        // Migration is this line: a previously plaintext field becomes the
+        // marker on the first successful keychain write.
+        record.msGraphRefreshToken = KEYCHAIN_MARKER;
+      } catch {
+        /* keychain unavailable — the plaintext field above stands */
+      }
+    }
+  } else {
+    if (record.msGraphRefreshToken === KEYCHAIN_MARKER && keychainUsable()) {
+      keychainDelete(backendURL);
+    }
+    delete record.msGraphRefreshToken;
+  }
+  writeAll(sessions, getDefaultBackend());
+  return true;
+}
+
 // Back-compat writer: upsert a single session (used by tests and any v1 caller).
 export function writeSessionConfig({ backendURL, sessionToken }) {
   if (!backendURL || !sessionToken) {

package/src/bridge/engine-download.mjs

@@ -141,6 +141,25 @@ export function resolveAssetExt(mimeType, buf) {
   return extFromBytes(buf) ?? declared;
 }
 
+// The recolour descriptor, with a pane-free TINT REFUSAL folded in: the bytes
+// on disk are then the original ones, so `applied` has to read false and the
+// note has to name the one route that does bake a colour in.
+function describeRecolorWithRefusal(markup, mimeType, iconColor, refusedColor) {
+  const described = describeRecolor(
+    markup,
+    mimeType,
+    refusedColor ? null : (iconColor ?? null),
+  );
+  if (!refusedColor) return described;
+  return {
+    ...described,
+    note:
+      `Saved in its ORIGINAL colours — recolouring to ${refusedColor} runs in the slidemind add-in. ` +
+      "Re-run this download with --to <presId> (a PowerPoint window with the slidemind pane open) " +
+      "to bake the colour in.",
+  };
+}
+
 // Stream one result into assetsDir via the add-in's streaming route.
 //
 // Returns the same shape as `downloadOneResult`, or null when the paired add-in
@@ -156,21 +175,29 @@ async function streamOneResult({
   iconColor,
 }) {
   if (typeof client.engineDownloadToFile !== "function") return null;
+  // `presId: null` + a resolved backendURL is the pane-free route (the client
+  // picks the direct stream); a presId relays through that window's pane.
   // Write under a provisional name: the true extension is only knowable from the
   // bytes, and buffering the image just to sniff its header would defeat the
   // purpose of streaming.
   const tempPath = path.join(assetsDir, `.engine-${searchId}-${selection}.part`);
-  let res;
-  try {
-    res = await client.engineDownloadToFile({
+  const fetchOnce = (color) =>
+    client.engineDownloadToFile({
       presId,
       backendURL,
       searchId,
       selection,
       destPath: tempPath,
-      iconColor: iconColor ?? null,
+      iconColor: color ?? null,
       onProgress: createTransferProgress(`downloading result ${selection}`),
     });
+  let res;
+  // Set when the pane-free route refused the TINT (not the asset): the download
+  // then repeats without a colour so the caller still gets the icon, and the
+  // recolour is reported as not applied instead of silently claimed.
+  let recolorRefused = null;
+  try {
+    res = await fetchOnce(iconColor);
   } catch (err) {
     fs.rmSync(tempPath, { force: true });
     // Route absent → this add-in predates streaming; let the caller fall back.
@@ -178,7 +205,13 @@ async function streamOneResult({
     // for a stale selection), not Express saying "no such path" — retrying that
     // on the capped path would just fail again, more slowly.
     if ((err?.status === 404 && !err?.code) || err?.status === 501) return null;
-    throw err;
+    // The recolour classifier is DOM-based and lives in the add-in, so the
+    // pane-free route refuses a tint rather than guessing at one. Refusing the
+    // whole DOWNLOAD over it would be worse: the icon is fetchable, only the
+    // colour is not. Take the bytes and say so.
+    if (err?.code !== "recolor_needs_host" || !iconColor) throw err;
+    recolorRefused = iconColor;
+    res = await fetchOnce(null);
   }
 
   try {
@@ -193,7 +226,12 @@ async function streamOneResult({
         path: target,
         reference: `./assets/${filename}`,
         mimeType: res.mimeType ?? "image/svg+xml",
-        recolor: describeRecolor(res.svgMarkup, res.mimeType, iconColor ?? null),
+        recolor: describeRecolorWithRefusal(
+          res.svgMarkup,
+          res.mimeType,
+          iconColor,
+          recolorRefused,
+        ),
         size: svgSizeFromMarkup(res.svgMarkup),
       };
     }
@@ -222,7 +260,12 @@ async function streamOneResult({
       path: target,
       reference: `./assets/${filename}`,
       mimeType: res.mimeType ?? null,
-      recolor: describeRecolor(null, res.mimeType, iconColor ?? null),
+      recolor: describeRecolorWithRefusal(
+        null,
+        res.mimeType,
+        iconColor,
+        recolorRefused,
+      ),
       size: imageSizeFromBuffer(probe),
     };
   } catch (err) {
@@ -237,7 +280,7 @@ async function streamOneResult({
 // the rest.
 export async function downloadOneResult({
   client,
-  presId,
+  presId = null,
   backendURL = null,
   searchId,
   assetsDir,
@@ -259,6 +302,16 @@ export async function downloadOneResult({
   });
   if (streamed) return streamed;
 
+  // The capped base64 fallback below is a PANE route. On the pane-free path
+  // there is no window to relay through — and an add-in that serves the direct
+  // routes always serves the direct stream — so a missing stream there is a real
+  // failure, not a reason to reach for a window that may not exist.
+  if (!presId) {
+    throw new Error(
+      "the add-in's engine routes returned no bytes for that result — re-run the search, then pick again",
+    );
+  }
+
   // Fallback for an add-in that predates the streaming route: bytes ride the
   // pane's Socket.IO ack, capped by its 10 MB frame limit.
   const res = await client.engineDownload({