fix auth

Author: Cesar-M-Diaz

packages/core/src/auth/auth-manager.ts

@@ -37,15 +37,33 @@ function checkRequiredPermissions (
   }
 }
 
-function checkCachedPermissionsIfKnown (
+function failUnknownRequiredPermissions (
+  required: string[],
+  reason: string,
+  cause?: unknown
+): never {
+  throw new PermissionError(
+    required,
+    `Cannot verify required permissions: ${required.join(', ')}. ` +
+    `${reason} Retry when validation is available or re-authenticate.`,
+    { cause }
+  )
+}
+
+function checkCachedPermissions (
   required: string[],
   existing: Credentials,
-  logger?: Logger
+  logger?: Logger,
+  cause?: unknown
 ): void {
   if (required.length === 0) return
   if (existing.permissions === undefined) {
     logger?.debug('auth.credentials.cachedPermissionsUnknown', { orgId: existing.organizationId })
-    return
+    failUnknownRequiredPermissions(
+      required,
+      'Token validation is unavailable and cached credentials do not include permission evidence.',
+      cause
+    )
   }
   checkRequiredPermissions(required, existing.permissions)
 }
@@ -97,11 +115,11 @@ export async function ensureAuthenticated (authConfig: AuthConfig, logger?: Logg
           throw err
         }
         // API unavailable, timed out, or served a non-JSON fallback: keep setup
-        // idempotent by trusting the unexpired, origin-matching credentials. If
-        // this credentials file already has a permission cache, still enforce
-        // requiredPermissions against that known local state.
+        // idempotent by trusting the unexpired, origin-matching credentials
+        // only when no permissions are required, or when cached permissions
+        // locally prove the requested access.
         logger?.warn('auth.credentials.validationUnavailable', { error: (err as Error).message })
-        checkCachedPermissionsIfKnown(required, existing, logger)
+        checkCachedPermissions(required, existing, logger, err)
         return existing
       }
     }
@@ -179,6 +197,13 @@ export async function ensureAuthenticated (authConfig: AuthConfig, logger?: Logg
     if (err instanceof InvalidCredentialsError || err instanceof PermissionError) {
       throw err
     }
+    if (required.length > 0) {
+      failUnknownRequiredPermissions(
+        required,
+        'Token validation is unavailable, so fresh OAuth credentials cannot be authorized locally.',
+        err
+      )
+    }
     // API unavailable - store optimistically
     logger?.warn('Could not validate token. Storing credentials optimistically.', { consoleId: callback.consoleId })
     const creds: Credentials = {

packages/core/test/integration/auth/auth-manager.test.ts

@@ -452,7 +452,7 @@ describe('ensureAuthenticated - requiredPermissions', () => {
     assert.strictEqual(execFileCalls.length, 0)
   })
 
-  it('trusts stored credentials with unknown cached permissions when validation is unavailable', async () => {
+  it('rejects stored credentials with unknown cached permissions when validation is unavailable', async () => {
     const { saveCredentials } = await import('../../../src/auth/token-storage.js')
 
     const creds: Credentials = {
@@ -472,13 +472,39 @@ describe('ensureAuthenticated - requiredPermissions', () => {
     }) as unknown as typeof fetch
 
     const { ensureAuthenticated } = await import('../../../src/auth/auth-manager.js')
-    const result = await ensureAuthenticated(authConfigWithPerms)
 
-    assert.deepStrictEqual(result, creds)
+    await assert.rejects(
+      ensureAuthenticated(authConfigWithPerms),
+      /Cannot verify required permissions: nsolid:benchmark:run, nsolid:profile:read/
+    )
     assert.strictEqual(fetchCalls, 1)
     assert.strictEqual(execFileCalls.length, 0)
   })
 
+  it('does not store fresh OAuth credentials when required permissions cannot be verified', { timeout: 10000 }, async () => {
+    const { loadCredentials } = await import('../../../src/auth/token-storage.js')
+
+    let fetchCalls = 0
+    globalThis.fetch = (async () => {
+      fetchCalls++
+      throw new Error('ECONNREFUSED')
+    }) as unknown as typeof fetch
+
+    const { ensureAuthenticated } = await import('../../../src/auth/auth-manager.js')
+    const promise = ensureAuthenticated(authConfigWithPerms)
+    const rejection = assert.rejects(
+      promise,
+      /Cannot verify required permissions: nsolid:benchmark:run, nsolid:profile:read/
+    )
+
+    const state = await pollForState(getStateFromExecFileCall)
+    await sendCallback(8767, state)
+    await rejection
+    assert.strictEqual(fetchCalls, 1)
+    assert.strictEqual(execFileCalls.length, 1)
+    assert.strictEqual(loadCredentials(), null)
+  })
+
   it('does not store fresh OAuth credentials when validation reports missing required permissions', { timeout: 10000 }, async () => {
     const { loadCredentials } = await import('../../../src/auth/token-storage.js')