Daemon-token producer — rotation + file persistence, test-harness only.
No production assembly mints daemon tokens: the credential's only remaining
role is the cross-process test harness's keeper channel (_testing_reset
etc.), so the producer lives here behind assert_dev_env where it cannot
reach a production bundle. The *consumer* half — validating a presented
X-Daemon-Token — stays in auth/daemon_token_middleware.ts, mirroring
the Rust spine, whose producer is confined to fuz_testing.
The token file is written atomically at mode 0600 via
write_file_atomic (unique temp name + exclusive create), so it never
exists group/other-readable — the old optional-chmod pattern let a
default umask land it at 0644.
7 declarations
testing/daemon_token_rotation.ts view source
DaemonTokenRotation import type {DaemonTokenRotation} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Result of starting daemon token rotation.
stateThe mutable runtime state. Pass to create_daemon_token_middleware.
type DaemonTokenState
stopStop rotation, clean up the interval, and delete the token file. Call on graceful shutdown.
type () => Promise<void>
testing/daemon_token_rotation.ts view source
DaemonTokenRotationOptions import type {DaemonTokenRotationOptions} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Options for daemon token rotation.
token_pathAbsolute path the token file is written to. Caller computes from
its own conventions — e.g. get_daemon_token_path(runtime, app_name)
for the standard ~/.{name}/run/daemon_token layout, or a path
derived from PUBLIC_<APP>_DIR for cross-process test setups that
isolate the app dir to a tmpdir.
type string
rotation_interval_ms?Rotation interval in ms. Default: 30000 (30s).
type number
testing/daemon_token_rotation.ts view source
DaemonTokenWriteDeps import type {DaemonTokenWriteDeps} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Deps for writing the daemon token to disk.
env_getGet an environment variable value.
type (name: string): string | undefined
namestringstring | undefinedmkdirCreate a directory. mode applies at creation (no-op where modes don't apply).
type (path: string, options?: { recursive?: boolean | undefined; mode?: number | undefined; } | undefined): Promise<void>
pathstringoptions?{ recursive?: boolean | undefined; mode?: number | undefined; } | undefinedPromise<void>write_text_fileWrite text to a file. See WriteFileOptions for mode / exclusive.
type (path: string, content: string, options?: WriteFileOptions | undefined): Promise<void>
pathstringcontentstringoptions?WriteFileOptions | undefinedPromise<void>renameRename (move) a file.
type (old_path: string, new_path: string): Promise<void>
old_pathstringnew_pathstringPromise<void>testing/daemon_token_rotation.ts view source
30000 import {DEFAULT_ROTATION_INTERVAL_MS} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Default rotation interval in milliseconds (30 seconds).
testing/daemon_token_rotation.ts view source
(runtime: Pick<EnvDeps, "env_get">, name: string): string | null import {get_daemon_token_path} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Get the daemon token file path (~/.{name}/run/daemon_token).
runtimeruntime with env_get capability
Pick<EnvDeps, "env_get">nameapplication name
stringstring | null path to daemon_token, or null if $HOME is not set
testing/daemon_token_rotation.ts view source
(runtime: Pick<EnvDeps, "env_get"> & Pick<FsWriteDeps, "mkdir" | "write_text_file" | "rename"> & FsRemoveDeps, deps: QueryDeps, options: DaemonTokenRotationOptions, log: Logger): Promise<...> import {start_daemon_token_rotation} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Start daemon token rotation.
Generates an initial token, writes it to disk, resolves the keeper account, and sets up periodic rotation. Returns the mutable state object and a stop function.
runtimeruntime with file and remove capabilities
Pick<EnvDeps, "env_get"> & Pick<FsWriteDeps, "mkdir" | "write_text_file" | "rename"> & FsRemoveDepsdepsquery dependencies for resolving keeper account
optionsrotation configuration
logthe logger instance
LoggerPromise<DaemonTokenRotation> rotation state and stop function
filesystem — writes the token file on each rotation; `stop` removes ittesting/daemon_token_rotation.ts view source
(runtime: DaemonTokenWriteDeps, token_path: string, token: string): Promise<void> import {write_daemon_token} from '@fuzdev/fuz_app/testing/daemon_token_rotation.js'; Write the current token to disk atomically at mode 0600.
On-disk format is JSON {"token": "..."} — the wrapper leaves room for
future fields (rotated_at, version) without changing every reader. Both
the TS cross-backend harness reader (spawn_backend.read_daemon_token)
and the Rust daemon-token writer match this shape.
runtimeruntime with file write capabilities
token_pathpath to write the token
stringtokenthe raw token string
stringPromise<void> filesystem — writes `token_path` atomically at mode `0600`