teleportation-cli 1.1.4 → 1.2.0

package/.claude/hooks/config-loader.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
 // Shared config loader for all hooks
 // Reads from encrypted credentials (~/.teleportation/credentials), then ~/.teleportation-config.json, then env vars
+// PRD-0019: Supports JWT authentication with automatic token refresh
 
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
@@ -12,6 +13,33 @@ import { fileURLToPath } from 'node:url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+// Path resolution helper for auth modules
+const AUTH_MODULE_PATHS = [
+  // If hook is still in project directory
+  () => join(process.cwd(), 'lib', 'auth'),
+  // If installed globally, try common locations
+  () => join(homedir(), '.teleportation', 'lib', 'auth'),
+  // Try relative to hook location (if hooks are symlinked)
+  () => join(__dirname, '..', '..', 'lib', 'auth')
+];
+
+/**
+ * Try to import a module from multiple possible paths
+ */
+async function tryImportModule(moduleName) {
+  for (const getPath of AUTH_MODULE_PATHS) {
+    const modulePath = join(getPath(), moduleName);
+    try {
+      const module = await import(modulePath);
+      return module;
+    } catch (e) {
+      // Try next path
+      continue;
+    }
+  }
+  return null;
+}
+
 export async function loadConfig() {
   // Test override: allow forcing config to be loaded from environment variables only
   // This is useful for unit tests that mock the relay API.
@@ -20,46 +48,70 @@ export async function loadConfig() {
       relayApiUrl: env.RELAY_API_URL || '',
       relayApiKey: env.RELAY_API_KEY || '',
       userToken: env.DETACH_USER_TOKEN || '',
-      slackWebhookUrl: env.SLACK_WEBHOOK_URL || ''
+      slackWebhookUrl: env.SLACK_WEBHOOK_URL || '',
+      authMethod: 'env'
     };
   }
 
-  // Priority 1: Try to load from encrypted credentials file
+  // Priority 1: Try JWT authentication (PRD-0019)
+  // This provides automatic token refresh for short-lived access tokens
   try {
-    // Try multiple possible paths for the credential manager
-    const possiblePaths = [
-      // If hook is still in project directory
-      join(process.cwd(), 'lib', 'auth', 'credentials.js'),
-      // If installed globally, try common locations
-      join(homedir(), '.teleportation', 'lib', 'auth', 'credentials.js'),
-      // Development path (if running from workspace)
-      join(homedir(), 'dev_env', 'teleporter', 'teleportation', 'lib', 'auth', 'credentials.js'),
-      // Try relative to hook location (if hooks are symlinked)
-      join(__dirname, '..', '..', 'lib', 'auth', 'credentials.js')
-    ];
-    
-    let CredentialManager = null;
-    for (const credentialsPath of possiblePaths) {
-      try {
-        const module = await import(credentialsPath);
-        CredentialManager = module.CredentialManager;
-        if (CredentialManager) break;
-      } catch (e) {
-        // Try next path
-        continue;
+    const tokenRefreshModule = await tryImportModule('token-refresh.js');
+    if (tokenRefreshModule && tokenRefreshModule.getValidAccessToken) {
+      const { getValidAccessToken, getAuthMethod } = tokenRefreshModule;
+
+      // Check if JWT credentials are available
+      const authInfo = await getAuthMethod();
+      if (authInfo.method === 'jwt') {
+        // Get a valid access token (refreshes automatically if needed)
+        const accessToken = await getValidAccessToken();
+
+        // Load credentials for other config values
+        const credentialsModule = await tryImportModule('credentials.js');
+        let relayApiUrl = '';
+        let slackWebhookUrl = '';
+
+        if (credentialsModule && credentialsModule.CredentialManager) {
+          const manager = new credentialsModule.CredentialManager();
+          const credentials = await manager.load();
+          if (credentials) {
+            relayApiUrl = credentials.relayApiUrl || credentials.relay_api_url || '';
+            slackWebhookUrl = credentials.slackWebhookUrl || credentials.slack_webhook_url || '';
+          }
+        }
+
+        return {
+          relayApiUrl,
+          relayApiKey: accessToken, // JWT access token used as Bearer token
+          userToken: '',
+          slackWebhookUrl,
+          authMethod: 'jwt'
+        };
       }
     }
-    
-    if (CredentialManager) {
-      const manager = new CredentialManager();
+  } catch (e) {
+    // JWT auth failed (token refresh error, etc.) - fall back to legacy auth
+    // Common errors: session expired, network issues, etc.
+    if (env.DEBUG) {
+      console.error(`[ConfigLoader] JWT auth failed: ${e.message}`);
+    }
+  }
+
+  // Priority 2: Try to load from encrypted credentials file (legacy API key)
+  try {
+    const credentialsModule = await tryImportModule('credentials.js');
+
+    if (credentialsModule && credentialsModule.CredentialManager) {
+      const manager = new credentialsModule.CredentialManager();
       const credentials = await manager.load();
-      
+
       if (credentials) {
         return {
           relayApiUrl: credentials.relayApiUrl || credentials.relay_api_url || '',
           relayApiKey: credentials.relayApiKey || credentials.apiKey || credentials.relay_api_key || '',
           userToken: credentials.userToken || credentials.user_token || '',
-          slackWebhookUrl: credentials.slackWebhookUrl || credentials.slack_webhook_url || ''
+          slackWebhookUrl: credentials.slackWebhookUrl || credentials.slack_webhook_url || '',
+          authMethod: 'api-key'
         };
       }
     }
@@ -67,9 +119,9 @@ export async function loadConfig() {
     // Credential manager not available or credentials don't exist, continue to fallback
   }
   
-  // Priority 2: Try to load from legacy config file
+  // Priority 3: Try to load from legacy config file
   const configPath = join(homedir(), '.teleportation-config.json');
-  
+
   try {
     const content = await readFile(configPath, 'utf8');
     const config = JSON.parse(content);
@@ -77,17 +129,19 @@ export async function loadConfig() {
       relayApiUrl: config.relay_api_url || '',
       relayApiKey: config.relay_api_key || '',
       userToken: config.user_token || '',
-      slackWebhookUrl: config.slack_webhook_url || ''
+      slackWebhookUrl: config.slack_webhook_url || '',
+      authMethod: 'legacy-config'
     };
   } catch (e) {
     // Config file doesn't exist, continue to fallback
   }
-  
-  // Priority 3: Fall back to environment variables
+
+  // Priority 4: Fall back to environment variables
   return {
     relayApiUrl: env.RELAY_API_URL || '',
     relayApiKey: env.RELAY_API_KEY || '',
     userToken: env.DETACH_USER_TOKEN || '',
-    slackWebhookUrl: env.SLACK_WEBHOOK_URL || ''
+    slackWebhookUrl: env.SLACK_WEBHOOK_URL || '',
+    authMethod: 'env'
   };
 }