Skip to content

fix(auth): persist rotated refresh token from tokenrefresh response - #220

Open
nezumi0627 wants to merge 1 commit into
evex-dev:mainfrom
nezumi0627:fix/auth-persist-rotated-refresh-token
Open

fix(auth): persist rotated refresh token from tokenrefresh response#220
nezumi0627 wants to merge 1 commit into
evex-dev:mainfrom
nezumi0627:fix/auth-persist-rotated-refresh-token

Conversation

@nezumi0627

Copy link
Copy Markdown
Contributor

Summary

AuthService.tryRefreshToken() discarded the rotated refresh token returned by the server.

RefreshAccessTokenResponse explicitly carries a refreshToken field (packages/types/line_types.ts:13446), and every login path persists the initial one (client/login.ts:110-111, base/login/mod.ts:163-164, 306, 618) — but the refresh path only updated accessToken and expire:

const RATR = await this.refresh({ request: { refreshToken } });
this.client.authToken = RATR.accessToken;
await this.client.storage.set("expire", ...);
// RATR.refreshToken silently dropped

If the server rotates the token (the reason the field exists), the next tryRefreshToken() reuses a stale/invalidated token and dies with a refresh error — permanently breaking long-lived sessions that rely on periodic token refresh.

Fix

Persist RATR.refreshToken when present, before writing expire.

Testing

New mod.test.ts following the existing stub-client pattern (relation/mod.test.ts):

  1. Response containing a rotated token → storage now holds "rt-new".
  2. Response without rotation → previously stored token is left untouched.

Full suite: deno test --allow-all passes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant