Method reAuthenticate

src/proxy/lifecycle/manager.js:934–1036

* Re-authenticate after 403: rotate secret via hello, then verify with a * heartbeat. Returns true if auth is restored, false otherwise. * * Recovery sequence (issue EvoMap/evolver#529): * attempt 1 -> hello with current Bearer + rotate_secret=true * (works when the s

()

   *                manual-reset hint to the user instead of churning forever.
   */
  async reAuthenticate() {
    if (this._reauthInProgress) return false;
    if (this._reauthBackoffUntil > Date.now()) {
      const waitSec = Math.ceil((this._reauthBackoffUntil - Date.now()) / 1000);
      this.logger.warn(`[lifecycle] re-auth suppressed: backoff active for ${waitSec}s`);
      return false;
    }
    this._reauthInProgress = true;
    let manualResetRequired = false;
    let hubUnreachable = false;
    let droppedDivergedSecret = false;
    try {
      for (let attempt = 1; attempt <= MAX_REAUTH_ATTEMPTS; attempt++) {
        this.logger.warn(`[lifecycle] re-auth attempt ${attempt}/${MAX_REAUTH_ATTEMPTS}: rotating secret via hello...`);
        const helloResult = await this.hello({ rotateSecret: true });
        if (!helloResult.ok) {
          this.logger.error(`[lifecycle] re-auth hello failed: ${helloResult.error}`);
          if (helloResult.error === 'hello_rate_limited' || helloResult.error === 'hello_rate_limit_active') break;
          // Hub link is down (WAF HTML, network error, timeout) -- NOT an auth
          // failure. Bail without arming the re-auth backoff: otherwise a
          // transient outage that arrives mid-rotate would burn both attempts
          // (attempt 2's hello short-circuits on the hub-unreachable window)
          // and suppress genuine auth recovery for up to REAUTH_BACKOFF_MAX_MS,
          // even though a JSON 401/403 retry would succeed once the hub is
          // reachable again. The hub-unreachable window already gates re-entry.
          if (helloResult.error === 'hub_unreachable' || helloResult.error === 'hub_unreachable_backoff') {
            hubUnreachable = true;
            break;
          }
          if (isSecretDivergenceError(helloResult.error)) {
            // The hub has explicitly rejected our current secret as diverged
            // from its record. Drop store/env-derived auth once, then spend
            // the second attempt on an unauthenticated rotate hello instead
            // of backing off while still presenting the same stale Bearer.
            if (attempt < MAX_REAUTH_ATTEMPTS && !droppedDivergedSecret) {
              this._dropLocalSecret(SECRET_DIVERGENCE_ERROR);
              droppedDivergedSecret = true;
              continue;
            }
            break;
          }
          if (typeof helloResult.error === 'string' && helloResult.error.startsWith('node_id_already_claimed')) {
            // Hub does not believe we own this nodeId. Our locally cached
            // secret(s) are useless. Drop them so attempt 2 retries WITHOUT
            // a Bearer (lenient hello path). If even unauthenticated rotate
            // is rejected, only a manual reset can recover.
            if (attempt < MAX_REAUTH_ATTEMPTS) {
              this._dropLocalSecret('node_id_already_claimed');
              continue;
            }
            manualResetRequired = true;
            break;
          }
          continue;
        }
        const newSecret = helloResult.response?.payload?.node_secret;
        if (!newSecret) {
          this.logger.error('[lifecycle] re-auth: hub did not return a new secret (rotate may not have taken effect)');