feat(runtime-auth): centralized token manager (editor half — fixes upload after token expiry)

src/__architecture__/validate.ts

@@ -1,3 +1,3 @@
 /**
  * Architecture validation script.
  *
@@ -155,6 +155,10 @@
   // openplc-web parity explicit (this folder is byte-identical
   // between repos).
   if (rel.startsWith('middleware/shared/utils/')) return 'utils'
+  // Shared runtime-auth (RuntimeTokenManager) is pure, dependency-free logic
+  // reachable from adapters/backend/main on both platforms — same `utils` rule
+  // set, byte-identical between repos.
+  if (rel.startsWith('middleware/shared/runtime-auth/')) return 'utils'
   if (rel.match(/^middleware\/adapters\/[^/]+\/components\//)) return 'adapter-components'
   if (rel.startsWith('middleware/adapters/')) return 'adapters'
 

src/backend/editor/compiler/__tests__/editor-compiler-platform-port.test.ts

@@ -149,9 +149,9 @@ describe('createEditorCompilerPlatformPort', () => {
       cleanBuild: false,
       mainProcessBridge: {
         makeRuntimeApiRequest: jest.fn(),
+        makeRuntimeApiUpload: jest.fn(),
       },
       compressSourceFolder: jest.fn(),
-      sendRuntimeUpload: jest.fn(),
       pollTimeoutMs: 1000,
       pollIntervalMs: 10,
       startTimeoutMs: 1000,
@@ -321,7 +321,7 @@ describe('createEditorCompilerPlatformPort', () => {
     })) as unknown as EditorCompilerPlatformPortContext['mainProcessBridge']['makeRuntimeApiRequest']
     const port = createEditorCompilerPlatformPort(
       makeHandlers(),
-      makeContext({ mainProcessBridge: { makeRuntimeApiRequest } }),
+      makeContext({ mainProcessBridge: { makeRuntimeApiRequest, makeRuntimeApiUpload: jest.fn() } }),
     )
     const result = await port.checkRuntimeVersion(
       { context: { kind: 'editor-https', ip: '10.0.0.1', jwt: 'token' } },
@@ -338,7 +338,7 @@ describe('createEditorCompilerPlatformPort', () => {
     const log = jest.fn()
     const port = createEditorCompilerPlatformPort(
       makeHandlers(),
-      makeContext({ mainProcessBridge: { makeRuntimeApiRequest } }),
+      makeContext({ mainProcessBridge: { makeRuntimeApiRequest, makeRuntimeApiUpload: jest.fn() } }),
     )
     const result = await port.checkRuntimeVersion(
       { context: { kind: 'editor-https', ip: '10.0.0.1', jwt: 'token' } },
@@ -355,7 +355,7 @@ describe('createEditorCompilerPlatformPort', () => {
     const log = jest.fn()
     const port = createEditorCompilerPlatformPort(
       makeHandlers(),
-      makeContext({ mainProcessBridge: { makeRuntimeApiRequest } }),
+      makeContext({ mainProcessBridge: { makeRuntimeApiRequest, makeRuntimeApiUpload: jest.fn() } }),
     )
     const result = await port.checkRuntimeVersion(
       { context: { kind: 'editor-https', ip: '10.0.0.1', jwt: 'token' } },

src/backend/editor/compiler/compiler-module.ts

@@ -50,10 +50,19 @@
 type LibraryCompileBridge = {
   makeRuntimeApiRequest: <T = void>(
     ipAddress: string,
-    jwtToken: string,
     endpoint: string,
     responseParser?: (data: string) => T,
   ) => Promise<{ success: true; data?: T } | { success: false; error: string }>
+  // Required to satisfy compileProgram's bridge contract; never invoked on the
+  // library path (it compiles with runtimeIpAddress=null, so no upload runs).
+  makeRuntimeApiUpload: (opts: {
+    ipAddress: string
+    fileBuffer: Buffer
+    filename: string
+    contentType: string
+    cleanBuild: boolean
+    onUploadAccepted?: (responseBody: string) => void
+  }) => Promise<{ success: true; data: string } | { success: false; error: string }>
   loadEnabledArchives: (enabledNames: string[]) => { archives: unknown[]; missing: string[] }
 }
 
@@ -495,8 +504,8 @@
 
   checkStrucppAvailability(): MethodsResult<string> {
     try {
       const { getVersion } = loadStrucpp()
       return { success: true, data: getVersion() }
     } catch {
       throw new Error('STruC++ not available. Run "npm run setup:binaries" to install it.')
     }
@@ -1903,73 +1912,8 @@
     })
   }
 
-  /**
-   * Send a compiled program file to the runtime's `/api/upload-file`
-   * over HTTPS via a multipart/form-data POST.  Pure transport — no
-   * polling, no PLC start, no UI logging.  Used as the `uploadProgram`
-   * callback fed to the shared `deployRuntimeProgram` orchestrator.
-   *
-   * v3 callers pass `program.st` + `text/plain`; v4 callers pass the
-   * compiled zip + `application/zip`.  `cleanBuild` toggles the
-   * `?clean=1` flag the runtime honours by wiping `build/` and ccache
-   * before compiling.
-   */
-  private async sendRuntimeUpload(opts: {
-    hostname: string
-    jwtToken: string
-    filename: string
-    contentType: string
-    fileBuffer: Buffer
-    cleanBuild: boolean
-    onUploadAccepted?: (responseBody: string) => void
-  }): Promise<{ success: boolean; error?: string }> {
-    const boundary = '----WebKitFormBoundary' + Math.random().toString(36).substring(2)
-    const header = Buffer.from(
-      `--${boundary}\r\n` +
-        `Content-Disposition: form-data; name="file"; filename="${opts.filename}"\r\n` +
-        `Content-Type: ${opts.contentType}\r\n\r\n`,
-    )
-    const footer = Buffer.from(`\r\n--${boundary}--\r\n`)
-    const body = Buffer.concat([header, opts.fileBuffer, footer] as unknown as ReadonlyArray<Uint8Array>)
-
-    return new Promise<{ success: boolean; error?: string }>((resolve) => {
-      const req = https.request(
-        {
-          hostname: opts.hostname,
-          port: 8443,
-          path: opts.cleanBuild ? '/api/upload-file?clean=1' : '/api/upload-file',
-          method: 'POST',
-          headers: {
-            'Content-Type': `multipart/form-data; boundary=${boundary}`,
-            'Content-Length': body.length,
-            Authorization: `Bearer ${opts.jwtToken}`,
-          },
-          ...getRuntimeHttpsOptions(),
-        } as https.RequestOptions,
-        (res: IncomingMessage) => {
-          let data = ''
-          res.on('data', (chunk: Buffer) => {
-            data += chunk.toString()
-          })
-          res.on('end', () => {
-            if (res.statusCode === 200) {
-              opts.onUploadAccepted?.(data)
-              resolve({ success: true })
-            } else {
-              resolve({ success: false, error: data || `HTTP ${res.statusCode}` })
-            }
-          })
-        },
-      )
-      req.setTimeout(300_000, () => {
-        req.destroy()
-        resolve({ success: false, error: 'Upload request timed out after 5 minutes' })
-      })
-      req.on('error', (err: Error) => resolve({ success: false, error: err.message }))
-      req.write(body)
-      req.end()
-    })
-  }
+  // Runtime upload moved to MainProcessBridge.makeRuntimeApiUpload so it shares
+  // the single token authority (transparent refresh + retry on an expired JWT).
 
   // !! Deprecated: This method is a outdated implementation and should be removed.
   async createXmlFile(
@@ -2457,10 +2401,17 @@
     mainProcessBridge: {
       makeRuntimeApiRequest: <T = void>(
         ipAddress: string,
-        jwtToken: string,
         endpoint: string,
         responseParser?: (data: string) => T,
       ) => Promise<{ success: true; data?: T } | { success: false; error: string }>
+      makeRuntimeApiUpload: (opts: {
+        ipAddress: string
+        fileBuffer: Buffer
+        filename: string
+        contentType: string
+        cleanBuild: boolean
+        onUploadAccepted?: (responseBody: string) => void
+      }) => Promise<{ success: true; data: string } | { success: false; error: string }>
       /**
        * Resolve a list of project-enabled library names to parsed
        * `.stlib` archives.  Bundled libraries are always-on and
@@ -2710,7 +2661,6 @@
         cleanBuild: cleanBuild ?? false,
         mainProcessBridge,
         compressSourceFolder: (folderPath: string) => this.compressSourceFolder(folderPath),
-        sendRuntimeUpload: (opts) => this.sendRuntimeUpload(opts),
         pollTimeoutMs: CompilerModule.COMPILATION_STATUS_TIMEOUT_MS,
         pollIntervalMs: CompilerModule.COMPILATION_STATUS_POLL_INTERVAL_MS,
         startTimeoutMs: POST_BUILD_START_TIMEOUT_MS,
@@ -2996,7 +2946,7 @@
           _mainProcessPort.postMessage({
             logLevel,
             message: data,
             ...(compileError ? { compileError } : {}),
           })
         },
         { hasCBlocks, pous: knownPous, libraries, missingLibraries },

src/backend/editor/compiler/editor-compiler-platform-port.ts

@@ -106,28 +106,26 @@
   mainProcessBridge: {
     makeRuntimeApiRequest: <T = void>(
       ipAddress: string,
-      jwtToken: string,
       endpoint: string,
       responseParser?: (data: string) => T,
     ) => Promise<{ success: true; data?: T } | { success: false; error: string }>
+    /** Upload the runtime-v4 program bundle. Owns token refresh internally
+     *  (via the token authority), so the upload self-heals on expiry like every
+     *  other runtime call. */
+    makeRuntimeApiUpload: (opts: {
+      ipAddress: string
+      fileBuffer: Buffer
+      filename: string
+      contentType: string
+      cleanBuild: boolean
+      onUploadAccepted?: (responseBody: string) => void
+    }) => Promise<{ success: true; data: string } | { success: false; error: string }>
   }
   /** Compress the source folder into the runtime v4 upload zip.
    *  Delegated through context so the port adapter doesn't pull
    *  in the `archiver`-dependent compressSourceFolder method (which
    *  has its own private state on CompilerModule). */
   compressSourceFolder: (folderPath: string) => Promise<Buffer>
-  /** Send the upload request to a runtime device.  Wraps
-   *  CompilerModule.sendRuntimeUpload with the right multipart
-   *  payload structure. */
-  sendRuntimeUpload: (opts: {
-    hostname: string
-    jwtToken: string
-    filename: string
-    contentType: string
-    fileBuffer: Buffer
-    cleanBuild: boolean
-    onUploadAccepted?: (responseBody: string) => void
-  }) => Promise<{ success: boolean; error?: string }>
   /** Timeout for the post-upload compile-status poll. */
   pollTimeoutMs: number
   /** Interval for the post-upload compile-status poll. */
@@ -158,7 +156,7 @@
      * adapter computes the same hash via `spark-md5`; both outputs
      * are byte-identical.
      */
     async computeMd5(input: string): Promise<string> {
       return createHash('md5').update(input).digest('hex')
     },
 
@@ -384,9 +382,8 @@
 
         const deployOutcome = await deployRuntimeProgram({
           uploadProgram: () =>
-            context.sendRuntimeUpload({
-              hostname: deviceContext.ip,
-              jwtToken: deviceContext.jwt,
+            context.mainProcessBridge.makeRuntimeApiUpload({
+              ipAddress: deviceContext.ip,
               filename: 'program.zip',
               contentType: 'application/zip',
               fileBuffer,
@@ -405,7 +402,7 @@
               status: string
               logs: string[]
               exit_code: number | null
-            }>(deviceContext.ip, deviceContext.jwt, '/api/compilation-status', (data: string) => {
+            }>(deviceContext.ip, '/api/compilation-status', (data: string) => {
               return JSON.parse(data) as { status: string; logs: string[]; exit_code: number | null }
             })
             if (!result.success) return { success: false, error: result.error }
@@ -414,7 +411,6 @@
           fetchStartResponse: async () => {
             const result = await context.mainProcessBridge.makeRuntimeApiRequest<string>(
               deviceContext.ip,
-              deviceContext.jwt,
               '/api/start-plc',
               (data: string) => {
                 const parsed = JSON.parse(data) as { status?: string }
@@ -486,9 +482,8 @@
         const fileBuffer = Buffer.from(args.programSt, 'utf-8')
         const deployOutcome = await deployRuntimeProgram({
           uploadProgram: () =>
-            context.sendRuntimeUpload({
-              hostname: deviceContext.ip,
-              jwtToken: deviceContext.jwt,
+            context.mainProcessBridge.makeRuntimeApiUpload({
+              ipAddress: deviceContext.ip,
               filename: 'program.st',
               contentType: 'text/plain',
               fileBuffer,
@@ -507,7 +502,7 @@
               status: string
               logs: string[]
               exit_code: number | null
-            }>(deviceContext.ip, deviceContext.jwt, '/api/compilation-status', (data: string) => {
+            }>(deviceContext.ip, '/api/compilation-status', (data: string) => {
               return JSON.parse(data) as { status: string; logs: string[]; exit_code: number | null }
             })
             if (!result.success) return { success: false, error: result.error }
@@ -516,7 +511,6 @@
           fetchStartResponse: async () => {
             const result = await context.mainProcessBridge.makeRuntimeApiRequest<string>(
               deviceContext.ip,
-              deviceContext.jwt,
               '/api/start-plc',
               (data: string) => {
                 const parsed = JSON.parse(data) as { status?: string }
@@ -556,7 +550,6 @@
         fetchVersion: async () => {
           const result = await context.mainProcessBridge.makeRuntimeApiRequest<{ version: string }>(
             deviceContext.ip,
-            '', // unauthenticated probe
             '/api/version',
             (data: string) => JSON.parse(data) as { version: string },
           )

src/frontend/hooks/use-runtime-polling.ts

@@ -1,3 +1,3 @@
 import { useCallback, useEffect, useRef } from 'react'
 
 import type { PlcStatus } from '../../middleware/shared/ports/types'
@@ -171,6 +171,20 @@
     }
   }, [runtime, handleConnectionLost, setPlcRuntimeStatus, setTimingStats, setEthercatStatus])
 
+  // Keep the store's connection token in lock-step with the platform's token
+  // authority. When the authority transparently refreshes an expired token
+  // (editor main process, or the web adapter's RuntimeTokenManager), it emits
+  // onTokenRefreshed; adopting it here means every store-reading consumer — the
+  // compile/upload pipeline, the connection-status UI — uses the live token
+  // instead of the one captured at login. Without this, an upload kicked off
+  // after the token aged out would use a stale token and 401.
+  useEffect(() => {
+    const unsubscribe = runtime.onTokenRefreshed?.((newToken) => {
+      useOpenPLCStore.getState().deviceActions.setRuntimeJwtToken(newToken)
+    })
+    return unsubscribe
+  }, [runtime])
+
   useEffect(() => {
     const { workspaceActions } = useOpenPLCStore.getState()