trackly-cli 0.13.4 → 0.14.1

package/lib/client.js

@@ -10,6 +10,7 @@ const { version: PACKAGE_VERSION } = require('../package.json');
 const DEFAULT_CONFIG_DIR = path.join(os.homedir(), '.trackly');
 const DEFAULT_BASE_URL = 'https://closeai.mba';
 const DEFAULT_HTTP_TIMEOUT_MS = 30000;
+const ANALYTICS_PREFERENCE_SYNC_TIMEOUT_MS = 1500;
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 const MAINTENANCE_CODE = 'maintenance_mode';
 const LEGACY_MAINTENANCE_CODE = 'planned_maintenance';
@@ -106,10 +107,180 @@ function saveConfig(config) {
 }
 
 function clearConfig() {
+  let config = {};
+  try {
+    const loaded = loadConfig();
+    if (loaded && typeof loaded === 'object' && !Array.isArray(loaded)) config = loaded;
+  } catch {
+    // Logout must still remove an invalid or unreadable credential file. The
+    // opt-out can be preserved only when the existing config is recoverable.
+  }
+  // A logout clears credentials and endpoint overrides, but the content-free
+  // analytics opt-out must continue suppressing anonymous MCP lifecycle events.
+  if (config.mcpAnalyticsOptOut === true) {
+    try {
+      saveConfig({ mcpAnalyticsOptOut: true });
+      return;
+    } catch {
+      // Preserving the marker is best-effort. A disk/write failure must never
+      // leave credentials behind, so fall through to unlinking the old file.
+    }
+  }
   const { file } = getConfigPaths();
   try { fs.unlinkSync(file); } catch (e) {}
 }
 
+function isRecord(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+
+function hasAuthenticationInConfig(config) {
+  return Boolean(
+    (process.env.TRACKLY_API_KEY || '').trim()
+    || (isRecord(config) && (config.apiKey || config.token || config.refreshToken))
+  );
+}
+
+function configAfterCredentialRemoval(config, scope) {
+  const next = isRecord(config) ? { ...config } : {};
+  if (scope === 'all' || scope === 'apiKey') delete next.apiKey;
+  if (scope === 'all' || scope === 'oauth') {
+    delete next.token;
+    delete next.refreshToken;
+  }
+  return next;
+}
+
+async function resolveAnalyticsOptOutBeforeCredentialLoss(
+  request = apiRequest,
+  timeoutMs = ANALYTICS_PREFERENCE_SYNC_TIMEOUT_MS
+) {
+  const controller = new AbortController();
+  let timeout;
+  try {
+    const preference = await Promise.race([
+      Promise.resolve().then(() => request(
+        'GET',
+        '/api/jobscout/analytics-preference',
+        null,
+        false,
+        true,
+        null,
+        null,
+        { signal: controller.signal, timeoutMs }
+      )),
+      new Promise((_, reject) => {
+        timeout = setTimeout(() => {
+          controller.abort();
+          reject(new Error('analytics_preference_sync_timeout'));
+        }, timeoutMs);
+      }),
+    ]);
+    if (typeof preference?.shareUsageAnalytics !== 'boolean') {
+      throw new Error('analytics_preference_invalid');
+    }
+    return preference.shareUsageAnalytics === false;
+  } catch {
+    // Fail closed: if the authoritative preference cannot be read before the
+    // final credential disappears, suppress future anonymous MCP capture.
+    return true;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function synchronizeAnalyticsPreferenceBeforeLogout(
+  request = apiRequest,
+  options = {}
+) {
+  const timeoutMs = options.timeoutMs ?? ANALYTICS_PREFERENCE_SYNC_TIMEOUT_MS;
+  try {
+    if (!hasAuth()) return;
+  } catch {
+    // A corrupt or unreadable config must never prevent logout. clearConfig()
+    // owns the best-effort removal path and will run immediately afterward.
+    return;
+  }
+  const optedOut = await resolveAnalyticsOptOutBeforeCredentialLoss(request, timeoutMs);
+  let config = {};
+  try {
+    const loaded = loadConfig();
+    if (loaded && typeof loaded === 'object' && !Array.isArray(loaded)) config = loaded;
+  } catch {
+    // Environment-provided authentication can still make the preference
+    // request valid when the on-disk config is corrupt. Replace only the
+    // recoverable analytics marker and let clearConfig() remove credentials.
+  }
+  if (optedOut) config.mcpAnalyticsOptOut = true;
+  else delete config.mcpAnalyticsOptOut;
+  try {
+    saveConfig(config);
+  } catch {
+    // Analytics synchronization is best-effort and must never block logout.
+  }
+}
+
+async function removeCredentials({
+  scope = 'all',
+  request = apiRequest,
+  timeoutMs = ANALYTICS_PREFERENCE_SYNC_TIMEOUT_MS,
+  preferenceUnavailable = false,
+} = {}) {
+  let config = {};
+  try {
+    const loaded = loadConfig();
+    if (isRecord(loaded)) config = loaded;
+  } catch {
+    // Corrupt or unreadable config still belongs to the best-effort removal
+    // path below. There is no safe credential state to preserve from it.
+  }
+
+  let next = configAfterCredentialRemoval(config, scope);
+  const removesEphemeralCredential = scope === 'all'
+    && Boolean((process.env.TRACKLY_API_KEY || '').trim());
+  const removesFinalCredential = removesEphemeralCredential
+    || (hasAuthenticationInConfig(config) && !hasAuthenticationInConfig(next));
+
+  if (removesFinalCredential) {
+    const optedOut = preferenceUnavailable
+      ? true
+      : await resolveAnalyticsOptOutBeforeCredentialLoss(request, timeoutMs);
+    if (optedOut) next.mcpAnalyticsOptOut = true;
+    else delete next.mcpAnalyticsOptOut;
+  }
+
+  if (scope === 'all') {
+    // Preserve logout's historical behavior of clearing endpoint overrides and
+    // all future config keys, with only the anonymous opt-out allowed through.
+    if (next.mcpAnalyticsOptOut === true) {
+      try {
+        saveConfig({ mcpAnalyticsOptOut: true });
+        return;
+      } catch {
+        // Credential removal wins over marker preservation on write failure.
+      }
+    }
+    const { file } = getConfigPaths();
+    try { fs.unlinkSync(file); } catch (_) {}
+    return;
+  }
+
+  if (Object.keys(next).length === 0) {
+    const { file } = getConfigPaths();
+    try { fs.unlinkSync(file); } catch (_) {}
+    return;
+  }
+  try {
+    saveConfig(next);
+  } catch (error) {
+    // If the surgical rewrite cannot be persisted, do not leave known-invalid
+    // credentials in the old file. Best-effort unlink is the safer fallback.
+    const { file } = getConfigPaths();
+    try { fs.unlinkSync(file); } catch (_) {}
+    throw error;
+  }
+}
+
 // Surgical alternative to clearConfig() for the refresh-failure path. Deletes ONLY the
 // OAuth credentials (token + refreshToken) while preserving everything else on disk
 // (baseUrl, apiKey, timeout overrides, future keys). A refresh token being invalidated
@@ -488,10 +659,10 @@ async function _doRefresh() {
     // Treat as an invalidated session and purge ONLY the OAuth pair so we don't retry on
     // every subsequent 401. Without this, a backend that signals failure via JSON instead of
     // a 4xx status would leave the user stuck in a doomed-refresh loop forever.
-    // Use clearOAuthTokens() — NOT clearConfig() — so the user's baseUrl, apiKey, and any
-    // other persisted settings survive a token expiry. (Bug caught by Cursor Bugbot on
-    // PR #20 post-review: the earlier clearConfig() call silently wiped baseUrl too.)
-    try { clearOAuthTokens(); } catch (_) {}
+    // Use the centralized OAuth-only removal — NOT clearConfig() — so the user's
+    // baseUrl, apiKey, and other persisted settings survive a token expiry while
+    // final-credential loss still preserves the analytics preference safely.
+    try { await removeCredentials({ scope: 'oauth', preferenceUnavailable: true }); } catch (_) {}
   } catch (e) {
     if (isMaintenanceError(e)) {
       throw e;
@@ -503,7 +674,7 @@ async function _doRefresh() {
     // purge the token. Surgical OAuth-only clear preserves baseUrl + apiKey + timeout overrides.
     const status = e && typeof e.status === 'number' ? e.status : null;
     if (status === 400 || status === 401 || status === 403) {
-      try { clearOAuthTokens(); } catch (_) {}
+      try { await removeCredentials({ scope: 'oauth', preferenceUnavailable: true }); } catch (_) {}
     }
   }
   return null;
@@ -516,7 +687,8 @@ function apiRequest(
   skipAuth = false,
   _isRetry = false,
   userAgent = null,
-  additionalHeaders = null
+  additionalHeaders = null,
+  requestOptions = null
 ) {
   return new Promise((resolve, reject) => {
     let url;
@@ -552,7 +724,15 @@ function apiRequest(
       headers['Idempotency-Key'] = idempotencyEntry[1];
     }
     const authMethod = getAuthMethod();
-    const timeoutMs = getRequestTimeoutMs();
+    const requestedTimeoutMs = Number(requestOptions?.timeoutMs);
+    const timeoutMs = Number.isFinite(requestedTimeoutMs) && requestedTimeoutMs > 0
+      ? Math.min(getRequestTimeoutMs(), requestedTimeoutMs)
+      : getRequestTimeoutMs();
+    const signal = requestOptions?.signal;
+    if (signal?.aborted) {
+      reject(new Error('Trackly request aborted.'));
+      return;
+    }
     const hasSensitivePayload = Boolean(data && typeof data === 'object' && 'refreshToken' in data);
 
     try {
@@ -640,7 +820,8 @@ function apiRequest(
                 false,
                 true,
                 userAgent,
-                additionalHeaders
+                additionalHeaders,
+                requestOptions
               );
               return resolve(retried);
             } catch (e) { return reject(e); }
@@ -671,6 +852,9 @@ function apiRequest(
     req.on('timeout', () => {
       req.destroy(new Error(`Trackly request timed out after ${timeoutMs}ms`));
     });
+    const abortRequest = () => req.destroy(new Error('Trackly request aborted.'));
+    signal?.addEventListener('abort', abortRequest, { once: true });
+    req.on('close', () => signal?.removeEventListener('abort', abortRequest));
     req.on('error', reject);
     if (data) req.write(JSON.stringify(data));
     req.end();
@@ -827,7 +1011,9 @@ module.exports = {
   normalizeMaintenance,
   normalizeEndpoint,
   refreshAccessToken,
+  removeCredentials,
   saveConfig,
+  synchronizeAnalyticsPreferenceBeforeLogout,
   CONFIG_DIR: DEFAULT_CONFIG_DIR,
   CONFIG_FILE: path.join(DEFAULT_CONFIG_DIR, 'config.json'),
 };