teamclaude-cloud 1.4.1 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",
@@ -35,4 +35,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}

package/src/cloud.js

@@ -305,6 +305,27 @@ export async function cloudRefreshToken(cloud, authKey, accountUuid, minRemainin
   };
 }
 
+/**
+ * Report a locally-rotated token back to the cloud (auth-key authenticated).
+ * When a consumer had to refresh a token LOCALLY (cloud refresh unreachable), it
+ * MUST push the rotated token back — otherwise the cloud keeps a now-dead refresh
+ * token and every other consumer (and the cloud's own /sync/refresh) fails with
+ * invalid_grant. Freshest-token-wins on the server, scoped to the key's group.
+ * Best-effort at the call site: a failure to report never breaks the local refresh.
+ */
+export async function cloudReportToken(cloud, authKey, accountUuid, { accessToken, refreshToken, expiresAt } = {}) {
+  requireCloud(cloud);
+  if (!authKey) throw new Error('Auth key required for token report.');
+  if (!accountUuid) throw new Error('accountUuid required for token report.');
+  const res = await httpJson(`${fnBase(cloud)}/sync/report-token`, {
+    method: 'POST',
+    headers: fnHeaders(cloud, { 'x-teamclaude-key': authKey }),
+    body: { accountUuid, accessToken, refreshToken, expiresAt: normalizeExpiresAt(expiresAt) || 0 },
+  });
+  if (!res.ok) throw new Error(`Cloud token report failed (${res.status}): ${describe(res.data)}`);
+  return { action: res.data.action || 'skipped' };
+}
+
 /**
  * Pull allowed accounts+tokens using an auth key (no owner session needed).
  * Returns `{ accounts, allowed, groupId, source }`:

package/src/index.js

@@ -7,7 +7,7 @@ import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConf
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
-import { cloudLogin, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
+import { cloudLogin, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
 
 const args = process.argv.slice(2);
@@ -1432,23 +1432,38 @@ const _autoPushInFlight = new Set();
  */
 async function maybePushRefreshedToken(config, account, newTokens) {
   const key = account.accountUuid || account.name;
+  const hasOwner = !!(config.cloud && config.cloud.session && config.cloud.session.access_token);
+  const pullKey = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  // Nothing to sync back to unless we're an admin (owner session) OR a consumer
+  // with a pull key. A consumer that rotated a token LOCALLY (cloud refresh was
+  // unreachable) MUST report it back, or the cloud keeps a now-dead refresh token
+  // and every consumer — plus the cloud's own /sync/refresh — fails invalid_grant.
+  if (!hasOwner && !(pullKey && account.accountUuid)) return;
   try {
-    if (!config.cloud || !config.cloud.session || !config.cloud.session.access_token) return; // not an admin/pusher
     if (_autoPushInFlight.has(key)) return;
     _autoPushInFlight.add(key);
-    const cloud = await ensureCloudSession(config).catch(() => config.cloud);
-    await cloudPush(cloud, [{
-      accountUuid: account.accountUuid,
-      name: account.name,
-      subscriptionType: account.subscriptionType,
-      tier: account.tier,
-      type: account.type,
-      accessToken: newTokens.accessToken,
-      refreshToken: newTokens.refreshToken,
-      expiresAt: newTokens.expiresAt,
-    }]);
+    if (hasOwner) {
+      const cloud = await ensureCloudSession(config).catch(() => config.cloud);
+      await cloudPush(cloud, [{
+        accountUuid: account.accountUuid,
+        name: account.name,
+        subscriptionType: account.subscriptionType,
+        tier: account.tier,
+        type: account.type,
+        accessToken: newTokens.accessToken,
+        refreshToken: newTokens.refreshToken,
+        expiresAt: newTokens.expiresAt,
+      }]);
+    } else {
+      // Consumer path: key-authenticated write-back (freshest-wins on the server).
+      await cloudReportToken(resolveCloud(config), pullKey, account.accountUuid, {
+        accessToken: newTokens.accessToken,
+        refreshToken: newTokens.refreshToken,
+        expiresAt: newTokens.expiresAt,
+      });
+    }
   } catch (err) {
-    console.error(`[TeamClaude] Cloud auto-push (token refresh) failed for ${account.name}: ${err.message}`);
+    console.error(`[TeamClaude] Cloud token sync-back failed for ${account.name}: ${err.message}`);
   } finally {
     _autoPushInFlight.delete(key);
   }