fail fast to logout on invalid refresh token

Author: charlesvien

packages/core/src/oauth/oauth.test.ts

@@ -122,6 +122,34 @@ describe("OAuthService.refreshToken", () => {
     expect(result.errorCode).toBe("auth_error");
   });
 
+  it("maps a 400 invalid_grant to an auth_error", async () => {
+    const { service } = createDeps();
+    fetchMock.mockResolvedValue(jsonResponse({ error: "invalid_grant" }, 400));
+
+    const result = await service.refreshToken("rt", "us");
+
+    expect(result.success).toBe(false);
+    expect(result.errorCode).toBe("auth_error");
+  });
+
+  it("maps a 400 invalid_client to an unknown_error, not a logout", async () => {
+    const { service } = createDeps();
+    fetchMock.mockResolvedValue(jsonResponse({ error: "invalid_client" }, 400));
+
+    const result = await service.refreshToken("rt", "us");
+
+    expect(result.errorCode).toBe("unknown_error");
+  });
+
+  it("maps a 400 with no parseable body to an unknown_error", async () => {
+    const { service } = createDeps();
+    fetchMock.mockResolvedValue(new Response("", { status: 400 }));
+
+    const result = await service.refreshToken("rt", "us");
+
+    expect(result.errorCode).toBe("unknown_error");
+  });
+
   it("maps 5xx to a server_error", async () => {
     const { service } = createDeps();
     fetchMock.mockResolvedValue(jsonResponse({}, 503));
@@ -133,7 +161,7 @@ describe("OAuthService.refreshToken", () => {
 
   it("maps other 4xx to an unknown_error", async () => {
     const { service } = createDeps();
-    fetchMock.mockResolvedValue(jsonResponse({}, 400));
+    fetchMock.mockResolvedValue(jsonResponse({}, 404));
 
     const result = await service.refreshToken("rt", "us");
 

packages/core/src/oauth/oauth.ts

@@ -216,8 +216,20 @@ export class OAuthService {
       });
 
       if (!response.ok) {
-        // 401/403 are auth errors - the token is invalid
-        const isAuthError = response.status === 401 || response.status === 403;
+        // 401/403 are always auth failures. A 400 is only a dead refresh token
+        // when the OAuth error is invalid_grant/invalid_token; other 400s like
+        // invalid_client or invalid_request are config bugs and must not log the
+        // user out, or they would be unable to log back in with the same broken
+        // config.
+        const oauthError =
+          response.status === 400
+            ? await this.readOAuthErrorCode(response)
+            : null;
+        const isAuthError =
+          response.status === 401 ||
+          response.status === 403 ||
+          oauthError === "invalid_grant" ||
+          oauthError === "invalid_token";
         // 5xx are server errors - should be retried
         const isServerError = response.status >= 500;
         this.log.warn(
@@ -249,6 +261,15 @@ export class OAuthService {
     }
   }
 
+  private async readOAuthErrorCode(response: Response): Promise<string | null> {
+    try {
+      const body = (await response.json()) as { error?: unknown };
+      return typeof body.error === "string" ? body.error : null;
+    } catch {
+      return null;
+    }
+  }
+
   /**
    * Cancel any pending OAuth flow.
    */