evoke old token on re-login to prevent token accumulation

Author: ivoIturrieta

src/commands/auth/login.tsx

@@ -6,6 +6,8 @@ import { App } from '../../components/App.js';
 import { KeyValue } from '../../components/KeyValue.js';
 import {
   setToken,
+  setTokenId,
+  getTokenId,
   setApiUrl,
   setWorkspaceId,
   setProjectId,
@@ -123,7 +125,8 @@ function LoginCommand({
         }
 
         authServerRef.current = server;
-        const url = getLoginWithCliAuthUrl(server.port, server.state);
+        const oldTokenId = getTokenId();
+        const url = getLoginWithCliAuthUrl(server.port, server.state, oldTokenId);
         setAuthUrl(url);
 
         await openWithFallback(url);
@@ -140,6 +143,9 @@ function LoginCommand({
         }
 
         setTokenValue(result.token);
+        if (result.tokenId) {
+          setTokenId(result.tokenId);
+        }
         setStep('verifying');
         server.close();
       } catch (err) {

src/lib/auth-server.ts

@@ -3,6 +3,7 @@ import { randomBytes } from 'node:crypto';
 
 export interface AuthResult {
   token: string;
+  tokenId: number | null;
   email: string;
 }
 
@@ -135,6 +136,7 @@ export async function startAuthServer(options?: {
     const callbackToken = url.searchParams.get('token');
     const callbackState = url.searchParams.get('state');
     const callbackEmail = url.searchParams.get('email') || '';
+    const callbackTokenId = url.searchParams.get('tokenId');
 
     // Validate state parameter
     if (callbackState !== state) {
@@ -155,7 +157,12 @@ export async function startAuthServer(options?: {
     res.end(SUCCESS_HTML);
 
     clearTimeout(timeoutId);
-    resolveAuth!({ token: callbackToken, email: callbackEmail });
+    const parsedTokenId = callbackTokenId ? parseInt(callbackTokenId, 10) : null;
+    resolveAuth!({
+      token: callbackToken,
+      tokenId: Number.isNaN(parsedTokenId) ? null : parsedTokenId,
+      email: callbackEmail,
+    });
   });
 
   // Bind to localhost only

src/lib/config.ts

@@ -19,6 +19,7 @@ export interface EnvironmentUrls {
 // ─── Config Interface ──────────────────────────────────────
 export interface UnlayerConfig {
   token?: string;
+  tokenId?: number | null;
   tokenEnvVar?: string;
   apiUrl?: string;
   workspaceId?: number | null;
@@ -33,6 +34,9 @@ const schema = {
   token: {
     type: 'string' as const,
   },
+  tokenId: {
+    type: ['number', 'null'] as const,
+  },
   tokenEnvVar: {
     type: 'string' as const,
     default: DEFAULT_TOKEN_ENV_VAR,
@@ -204,6 +208,15 @@ export function setToken(token: string): void {
 
 export function clearToken(): void {
   config.delete('token');
+  config.delete('tokenId');
+}
+
+export function getTokenId(): number | null | undefined {
+  return config.get('tokenId');
+}
+
+export function setTokenId(id: number | null): void {
+  config.set('tokenId', id);
 }
 
 export function getApiUrl(): string {

src/lib/urls.ts

@@ -24,13 +24,17 @@ export function getProjectCreateUrl(workspaceId: number | string): string {
 }
 
 /** CLI auth API route on the console (creates PAT and redirects to localhost callback) */
-export function getCliAuthUrl(port: number, state: string): string {
-  return `${getConsoleUrl()}/api/cli-auth?port=${port}&state=${encodeURIComponent(state)}`;
+export function getCliAuthUrl(port: number, state: string, tokenId?: number | null): string {
+  let url = `${getConsoleUrl()}/api/cli-auth?port=${port}&state=${encodeURIComponent(state)}`;
+  if (tokenId) {
+    url += `&tokenId=${tokenId}`;
+  }
+  return url;
 }
 
 /** Accounts login page with returnUrl pointing to cli-auth (chains: login → PAT → localhost) */
-export function getLoginWithCliAuthUrl(port: number, state: string): string {
-  const cliAuthUrl = getCliAuthUrl(port, state);
+export function getLoginWithCliAuthUrl(port: number, state: string, tokenId?: number | null): string {
+  const cliAuthUrl = getCliAuthUrl(port, state, tokenId);
   return `${getAccountsUrl()}/?returnUrl=${encodeURIComponent(cliAuthUrl)}`;
 }