feat(auth): force token refresh on rejected token (401/403), never the browser#1015

Merged

wpfleger96 merged 6 commits into

mainfrom

duncan/oauth-refresh-on-401

Jun 12, 2026

Commits on Jun 12, 2026

fix(auth): re-read disk cache in bearer() to handle multi-process refresh race

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
and
wpfleger96
committed
feat(auth): force token refresh on 401, never the browser

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
and
wpfleger96
committed
fix(auth): coalesce refresh_now by token identity, not expiry clock

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
and
wpfleger96
committed
fix(auth): refresh-and-retry on 403, not just 401

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
and
wpfleger96
committed
test(auth): prove 403 takes the same one-shot refresh-retry as 401

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
and
wpfleger96
committed
test(auth): prove a recoverable 403 clears after one refresh

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
and
wpfleger96
committed