Evan JarrettandClaude Fable 5 37bab324d7 fix OAuth refresh-token burn on client cancellation causing sign-outs ...

When a Docker client canceled a slow /auth/token request mid-refresh, the
token-refresh POST was aborted client-side but completed on the PDS, which
rotated the refresh token. The rotated token was never received or persisted,
so the next refresh replayed the consumed token, got invalid_grant, and the
session (OAuth + UI) was deleted, signing the user out everywhere.

- Detach refresh POSTs from the inbound request context via a per-session
  RoundTripper (WithoutCancel + 30s cap); once a refresh starts it completes
- Persist session updates (rotated tokens, DPoP nonces) on a detached context
- Gate session deletion on IsSessionInvalidError: cancellation, timeouts, and
  transport errors no longer delete sessions; genuine invalid_grant still does
- Add phase timing to /auth/token and per-DID lock wait warnings to attribute
  the ~14s pre-refresh stalls that push requests past Docker's deadline

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-02 13:38:45 -05:00

..

claims_test.go

type-ahead login api. fix app-passwords not working without oauth

2025-11-09 21:57:28 -06:00

claims.go

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

handler_concurrency_test.go

fix concurrency test

2026-05-16 12:18:06 -05:00

handler_test.go

fix concurrency test

2026-05-16 12:18:06 -05:00

handler.go

fix OAuth refresh-token burn on client cancellation causing sign-outs

2026-08-02 13:38:45 -05:00

issuer_test.go

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

issuer.go

lots of new work for authenticating between appview -> hold. fixed quota handling, improve integration tests for round-trip push/pull/auth/quota checking

2026-05-11 09:20:55 -05:00