fix: honor OAuth resource in auth probes

Use refreshed account snapshots and stored Comms resources when auth status and doctor validate OAuth tokens.

Author: amix

src/commands/auth/auth.test.ts

@@ -9,7 +9,7 @@ vi.mock('../../lib/auth.js', async (importOriginal) => {
     const actual = await importOriginal<typeof import('../../lib/auth.js')>()
     return {
         ...actual,
-        getAuthMetadata: vi.fn(),
+        getApiTokenSnapshot: vi.fn(),
         probeApiToken: vi.fn(),
     }
 })
@@ -88,15 +88,15 @@ import { attachLoginCommand } from '@doist/cli-core/auth'
 import { CommsRequestError, type User } from '@doist/comms-sdk'
 import { createWrappedCommsClient } from '../../lib/api.js'
 import { type CommsAccount, type CommsTokenStore } from '../../lib/auth-provider.js'
-import { getAuthMetadata, TOKEN_ENV_VAR } from '../../lib/auth.js'
+import { getApiTokenSnapshot, TOKEN_ENV_VAR } from '../../lib/auth.js'
 import { getConfig, updateConfig } from '../../lib/config.js'
 import { resetGlobalArgs } from '../../lib/global-args.js'
 import { registerAuthCommand } from './index.js'
 import { attachCommsStatusCommand } from './status.js'
 
 const mockCreateInterface = vi.mocked(createInterface)
 
-const mockGetAuthMetadata = vi.mocked(getAuthMetadata)
+const mockGetApiTokenSnapshot = vi.mocked(getApiTokenSnapshot)
 const mockCreateWrappedCommsClient = vi.mocked(createWrappedCommsClient)
 const mockAttachLoginCommand = vi.mocked(attachLoginCommand)
 const mockGetConfig = vi.mocked(getConfig)
@@ -392,22 +392,27 @@ describe('auth command', () => {
             vi.stubEnv(TOKEN_ENV_VAR, '')
             storeMocks.list.mockResolvedValue(STORED_RECORDS)
             storeMocks.active.mockResolvedValue(STORED_SNAPSHOT)
+            mockGetApiTokenSnapshot.mockResolvedValue({
+                token: 'tk_refreshed_1234567890',
+                account: {
+                    ...STORED_ACCOUNT,
+                    authResource: 'https://comms.staging.todoist.com',
+                },
+            })
             mockCreateWrappedCommsClient.mockReturnValue({
                 users: { getSessionUser: vi.fn().mockResolvedValue(TEST_USER) },
                 // biome-ignore lint/suspicious/noExplicitAny: only the methods used in this test matter
             } as any)
-            mockGetAuthMetadata.mockResolvedValue({
-                authMode: 'read-write',
-                authScope: 'user:read',
-                source: 'config',
-            })
             process.argv = ['node', 'tdc', '--user', '1', 'auth', 'status']
             resetGlobalArgs()
 
             await createProgram().parseAsync(['node', 'tdc', 'auth', 'status'])
 
             expect(storeMocks.active).toHaveBeenCalledWith('1')
-            expect(mockCreateWrappedCommsClient).toHaveBeenCalledWith('tk_stored_1234567890')
+            expect(mockGetApiTokenSnapshot).toHaveBeenCalledWith('1')
+            expect(mockCreateWrappedCommsClient).toHaveBeenCalledWith('tk_refreshed_1234567890', {
+                baseUrl: 'https://comms.staging.todoist.com',
+            })
             expect(consoleSpy).toHaveBeenCalledWith('✓ Authenticated')
         })
 
@@ -449,6 +454,7 @@ describe('auth command', () => {
             label: TEST_USER.fullName,
             authMode: 'read-write',
             authScope: COMMS_SCOPE,
+            authResource: 'https://comms.staging.todoist.com',
         }
 
         function programWithSnapshot(): Command {
@@ -482,21 +488,22 @@ describe('auth command', () => {
         }
 
         beforeEach(() => {
+            mockGetApiTokenSnapshot.mockResolvedValue({
+                token: 'snapshot_token',
+                account: SNAPSHOT_ACCOUNT,
+            })
             mockCreateWrappedCommsClient.mockReturnValue({
                 users: { getSessionUser: vi.fn().mockResolvedValue(TEST_USER) },
                 // biome-ignore lint/suspicious/noExplicitAny: only the methods used in this test matter
             } as any)
-            mockGetAuthMetadata.mockResolvedValue({
-                authMode: 'read-write',
-                authScope: COMMS_SCOPE,
-                source: 'config',
-            })
         })
 
         it('renders text status from the snapshot', async () => {
             await programWithSnapshot().parseAsync(['node', 'tdc', 'auth', 'status'])
 
-            expect(mockCreateWrappedCommsClient).toHaveBeenCalledWith('snapshot_token')
+            expect(mockCreateWrappedCommsClient).toHaveBeenCalledWith('snapshot_token', {
+                baseUrl: 'https://comms.staging.todoist.com',
+            })
             expect(consoleSpy).toHaveBeenCalledWith('✓ Authenticated')
             expect(consoleSpy).toHaveBeenCalledWith('  Email: test@example.com')
             expect(consoleSpy).toHaveBeenCalledWith('  Name:  Test User')

src/commands/auth/status.ts

@@ -4,7 +4,12 @@ import chalk from 'chalk'
 import type { Command } from 'commander'
 import { createWrappedCommsClient } from '../../lib/api.js'
 import type { CommsAccount, CommsTokenStore } from '../../lib/auth-provider.js'
-import { type AuthMetadata, getAuthMetadata, NoTokenError } from '../../lib/auth.js'
+import {
+    type AuthMetadata,
+    getApiTokenSnapshot,
+    NoTokenError,
+    TOKEN_ENV_VAR,
+} from '../../lib/auth.js'
 import type { AuthMode } from '../../lib/config.js'
 import { CliError } from '../../lib/errors.js'
 
@@ -24,19 +29,28 @@ function formatAuthMode(authMode: AuthMode, authScope?: string): string {
 }
 
 /**
- * Fetch the live session user (via the snapshot token) and the local auth
- * metadata concurrently — the API call dominates and the metadata read is
- * independent. 401-translation lives here so both the snapshot path and any
- * future callers emit the same `NO_TOKEN` envelope when the token is
- * rejected by the API.
+ * Fetch the live session user via the selected account's resource. 401
+ * translation lives here so both refreshed OAuth tokens and manual tokens emit
+ * the same `NO_TOKEN` envelope when Comms rejects them.
  */
-async function gatherStatusData(token: string): Promise<StatusData> {
+function metadataFromAccount(account: CommsAccount): AuthMetadata {
+    const authUserId = Number(account.id)
+    return {
+        authMode: account.authMode,
+        ...(account.authResource ? { authResource: account.authResource } : {}),
+        authScope: account.authScope || undefined,
+        authUserId: Number.isFinite(authUserId) && authUserId > 0 ? authUserId : undefined,
+        authUserName: account.label || undefined,
+        source: account.id || !process.env[TOKEN_ENV_VAR] ? 'config' : 'env',
+    }
+}
+
+async function gatherStatusData(token: string, account: CommsAccount): Promise<StatusData> {
     try {
-        const [user, metadata] = await Promise.all([
-            createWrappedCommsClient(token).users.getSessionUser(),
-            getAuthMetadata(),
-        ])
-        return { user, metadata }
+        const user = await createWrappedCommsClient(token, {
+            baseUrl: account.authResource,
+        }).users.getSessionUser()
+        return { user, metadata: metadataFromAccount(account) }
     } catch (error) {
         if (error instanceof CommsRequestError && error.httpStatusCode === 401) {
             throw new CliError('NO_TOKEN', 'Not authenticated (token expired or invalid)', [
@@ -71,23 +85,21 @@ function buildStatusJson({ user, metadata }: StatusData): Record<string, unknown
 /**
  * Attach `tdc auth status` via cli-core's generic `attachStatusCommand`.
  *
- * `CommsTokenStore.active()` returns a snapshot whenever a token resolves
- * (per the adapter's documented contract — see `auth-provider.ts`), so
- * `fetchLive` covers every token-present path: secure-store, plaintext
- * config fallback, env-token mode, and manual `tdc auth token`. The
- * snapshot's token is reused inside `gatherStatusData` so credentials are
- * read once per invocation. `onNotAuthenticated` only fires when nothing
- * is stored — it throws `NoTokenError` so the standard CliError envelope
- * reaches the operator unchanged.
+ * cli-core reads the selected account first. `fetchLive` then refreshes OAuth
+ * accounts through the same auth shim as normal API calls before validating
+ * the token against Comms. `onNotAuthenticated` only fires when nothing is
+ * stored — it throws `NoTokenError` so the standard CliError envelope reaches
+ * the operator unchanged.
  */
 export function attachCommsStatusCommand(auth: Command, store: CommsTokenStore): Command {
     let data: StatusData | null = null
 
     return attachStatusCommand<CommsAccount>(auth, {
         store,
         description: 'Show current authentication status',
-        fetchLive: async ({ token }) => {
-            data = await gatherStatusData(token)
+        fetchLive: async ({ account, token }) => {
+            const snapshot = account.id ? await getApiTokenSnapshot(account.id) : { account, token }
+            data = await gatherStatusData(snapshot.token, snapshot.account)
             return {
                 id: String(data.user.id),
                 label: data.user.fullName,

src/commands/doctor.test.ts

@@ -74,7 +74,11 @@ describe('doctor command', () => {
         mockGetConfig.mockResolvedValue({})
         mockProbeApiToken.mockResolvedValue({
             token: 'test_token_123456789',
-            metadata: { authMode: 'read-write', source: 'secure-store' },
+            metadata: {
+                authMode: 'read-write',
+                authResource: 'https://comms.staging.todoist.com',
+                source: 'secure-store',
+            },
         })
         mockCreateWrappedCommsClient.mockReturnValue({
             users: {
@@ -110,6 +114,9 @@ describe('doctor command', () => {
         expect(consoleSpy).toHaveBeenCalledWith(
             expect.stringContaining('PASS Authenticated as person@example.com via secure-store'),
         )
+        expect(mockCreateWrappedCommsClient).toHaveBeenCalledWith('test_token_123456789', {
+            baseUrl: 'https://comms.staging.todoist.com',
+        })
         expect(consoleSpy).toHaveBeenCalledWith(
             expect.stringContaining('PASS CLI is up to date on stable (v1.0.0)'),
         )

src/commands/doctor.ts

@@ -284,7 +284,7 @@ async function checkAuthentication(offline: boolean): Promise<DoctorCheck> {
     }
 
     try {
-        const api = createWrappedCommsClient(token)
+        const api = createWrappedCommsClient(token, { baseUrl: metadata.authResource })
         const user = await api.users.getSessionUser()
         details.email = user.email
         details.name = user.fullName

src/lib/auth.ts

@@ -25,6 +25,7 @@ export type TokenStorageResult = {
 
 export type AuthMetadata = {
     authMode: AuthMode
+    authResource?: string
     authScope?: string
     authUserId?: number
     authUserName?: string
@@ -33,6 +34,7 @@ export type AuthMetadata = {
 
 export type AuthProbeMetadata = {
     authMode: AuthMode
+    authResource?: string
     authScope?: string
     authUserId?: number
     authUserName?: string
@@ -69,8 +71,8 @@ export async function getApiToken(): Promise<string> {
     return snapshot.token
 }
 
-export async function getApiTokenSnapshot(): Promise<ActiveAuthSnapshot> {
-    return getActiveSnapshot({ refresh: true })
+export async function getApiTokenSnapshot(ref?: string): Promise<ActiveAuthSnapshot> {
+    return getActiveSnapshot({ refresh: true, ref })
 }
 
 /** Token + metadata in one round-trip for `tdc config view` / `tdc doctor`. */
@@ -86,9 +88,15 @@ export async function probeApiToken(): Promise<AuthProbeResult> {
     }
 }
 
-async function getActiveSnapshot({ refresh }: { refresh: boolean }): Promise<ActiveAuthSnapshot> {
+async function getActiveSnapshot({
+    refresh,
+    ref,
+}: {
+    refresh: boolean
+    ref?: string
+}): Promise<ActiveAuthSnapshot> {
     const store = createCommsTokenStore()
-    const snapshot = await store.activeBundle()
+    const snapshot = await store.activeBundle(ref)
     if (!snapshot) throw new NoTokenError()
 
     const { account, bundle } = snapshot
@@ -135,12 +143,14 @@ export async function getAuthMetadata(): Promise<AuthMetadata> {
 
 function toAccountFields(account: CommsAccount): {
     authMode: AuthMode
+    authResource?: string
     authScope?: string
     authUserId?: number
     authUserName?: string
 } {
     return {
         authMode: account.authMode,
+        ...(account.authResource ? { authResource: account.authResource } : {}),
         authScope: account.authScope || undefined,
         authUserId: account.id ? toAuthUserId(account.id) : undefined,
         authUserName: account.label || undefined,