ticketlens 0.38.26 → 0.38.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.26",
+  "version": "0.38.27",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/cli-auth.mjs

@@ -12,7 +12,12 @@ import { readMachineSecret, readOrCreateMachineSecret, signHmac, verifyHmac } fr
 const TOKEN_FILE = 'cli-token.json';
 // Distinct from license.mjs's LICENSE_HMAC_SALT so a license.json signature
 // can never be replayed as a valid cli-token.json tier signature, or vice versa.
-const CLI_TOKEN_HMAC_SALT = 'tl-tok-v1';
+export const CLI_TOKEN_HMAC_SALT = 'tl-tok-v1';
+// Shorter than license.mjs's 30-day GRACE_DAYS — a team seat being removed is a
+// security action by the manager, not a billing lapse, so the offline window a
+// revoked member's stale local access can survive on should be tighter.
+const TEAM_TIER_GRACE_DAYS = 7;
+const MS_PER_DAY = 86400000;
 
 export function cliTokenPath(configDir = DEFAULT_CONFIG_DIR) {
   return join(configDir, TOKEN_FILE);
@@ -34,21 +39,38 @@ export function readCliToken(configDir = DEFAULT_CONFIG_DIR) {
 // Lets team-invited members get Pro-equivalent CLI access without a personal
 // TL- key, mirroring what the manager already pays for.
 //
-// Signed with a machine-bound HMAC so `tier` can't be hand-edited in the file
-// to escalate entitlement. A missing or invalid signature is treated as no
-// tier at all (falls back to free) rather than trusted — self-heals on the
-// next `tl login`/`tl sync`, both of which re-write and re-sign it.
+// Signed with a machine-bound HMAC so `tier`/`syncedAt` can't be hand-edited in
+// the file to escalate or extend entitlement. A missing or invalid signature is
+// treated as no tier at all (falls back to free) rather than trusted — self-heals
+// on the next `tl login`/`tl sync`, both of which re-write and re-sign it. A file
+// with no `syncedAt` (written before this grace-period check existed) is rejected
+// outright for the same reason, rather than treated as permanently fresh.
+//
+// TEAM_TIER_GRACE_DAYS bounds how long a synced team-seat tier stays valid without
+// a fresh login/sync — mirrors license.mjs's offline GRACE_DAYS so a team member
+// removed server-side can't keep local access indefinitely just by never syncing.
 export function readCliTokenTier(configDir = DEFAULT_CONFIG_DIR) {
   const p = cliTokenPath(configDir);
   if (!existsSync(p)) return null;
   try {
     const data = JSON.parse(readFileSync(p, 'utf8'));
-    if (typeof data.tier !== 'string' || typeof data.tierSig !== 'string') return null;
+    if (typeof data.tier !== 'string' || typeof data.tierSig !== 'string' || typeof data.syncedAt !== 'string') {
+      return null;
+    }
     const secret = readMachineSecret(configDir);
     if (!secret) return null;
-    return verifyHmac(data.tierSig, { tier: data.tier }, `${CLI_TOKEN_HMAC_SALT}:${secret}`)
-      ? data.tier
-      : null;
+    const signed = { tier: data.tier, syncedAt: data.syncedAt };
+    if (!verifyHmac(data.tierSig, signed, `${CLI_TOKEN_HMAC_SALT}:${secret}`)) return null;
+
+    // An unparseable syncedAt gives NaN — rejected on its own line rather than
+    // leaning on NaN quietly failing the grace-period comparison below.
+    const syncedAtMs = new Date(data.syncedAt).getTime();
+    if (Number.isNaN(syncedAtMs)) return null;
+
+    const daysSinceSync = (Date.now() - syncedAtMs) / MS_PER_DAY;
+    if (daysSinceSync > TEAM_TIER_GRACE_DAYS) return null;
+
+    return data.tier;
   } catch {
     return null;
   }
@@ -60,8 +82,9 @@ export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR, tier = undef
   let payload = { token };
   if (tier !== undefined) {
     const secret = readOrCreateMachineSecret(configDir);
-    const tierSig = signHmac({ tier }, `${CLI_TOKEN_HMAC_SALT}:${secret}`);
-    payload = { token, tier, tierSig };
+    const syncedAt = new Date().toISOString();
+    const tierSig = signHmac({ tier, syncedAt }, `${CLI_TOKEN_HMAC_SALT}:${secret}`);
+    payload = { token, tier, syncedAt, tierSig };
   }
   writeFileSync(p, JSON.stringify(payload, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   chmodSync(p, 0o600);

package/skills/jtb/scripts/lib/sync.mjs

@@ -22,6 +22,16 @@ export const getApiBase     = () => apiBase();
 // Strip the api. subdomain to get the console base URL (e.g. api.ticketlens.app → ticketlens.app)
 export const getConsoleBase = () => getApiBase().replace('://api.', '://');
 
+/**
+ * Server wins on tier same as every other field this file syncs — a missing or
+ * non-string `tier` in the response must clear a stale locally-elevated tier
+ * rather than leave it untouched, so a downgrade (or a malformed response) can
+ * never be silently ignored.
+ */
+function resolveTierFromResponse(json) {
+  return typeof json?.tier === 'string' ? json.tier : 'free';
+}
+
 /**
  * Convert a server profile (snake_case) to the CLI profile shape (camelCase).
  * Returns { name, profileData } — no credential fields.
@@ -90,7 +100,7 @@ export async function syncProfiles({
   let json;
   try { json = await res.json(); } catch { return { error: 'invalid-json' }; }
 
-  if (typeof json?.tier === 'string') saveCliTokenTier(json.tier, configDir);
+  saveCliTokenTier(resolveTierFromResponse(json), configDir);
   saveTeams(Array.isArray(json?.teams) ? json.teams : [], configDir);
 
   const remoteProfiles = Array.isArray(json?.profiles) ? json.profiles : [];
@@ -159,6 +169,14 @@ export async function checkTeamMembershipUpdate({ configDir = DEFAULT_CONFIG_DIR
   let json;
   try { json = await res.json(); } catch { return { updated: false }; }
 
+  // Refresh the signed tier from the same payload this check already fetches —
+  // this fires on every `ticketlens TICKET-123` fetch, so it shrinks the real-world
+  // exposure window down from the grace period (cli-auth.mjs's TEAM_TIER_GRACE_DAYS)
+  // to "next fetch" for anyone who ever runs one. The grace period remains the
+  // backstop for local-only commands (history, schedule --local, review) that never
+  // reach this function at all.
+  saveCliTokenTier(resolveTierFromResponse(json), configDir);
+
   // Sanitized immediately on receipt — remoteTeams feeds both the banner
   // text below (built before saveTeams' own sanitization would ever run)
   // and the persisted cache, so both must see the cleaned name.