Files

T

angel 4e77052a37 Claude-assisted improvements (untested)

- dev auth flow (side-step OAuth)
- db event processing integration tests
- dev scripts (eg Makefile)
- db / test db migration setup scripts.

2026-08-19 23:20:15 -06:00

1.7 KiB

Raw Blame History

Work Summary — 2026-08-04 19:17

Task

Fix the RefreshAccessToken bug surfaced while adding test coverage (see work-summaries/work-summary-Claude-2026-08-04-1914.md), per explicit go-ahead.

Change

domains/authentication/auth.go:257: RefreshAccessToken was calling a.getRefreshTokenForAccessToken(ctx, accessToken), where accessToken is the function's empty named return value, not the oldAccessToken parameter it clearly meant to use (both are string, so the compiler had nothing to catch). This meant every real (non-dev) token refresh looked up a refresh token for "" instead of the actual expiring token, always failed, and sent the user back to / with a "failed to refresh access token" error instead of transparently refreshing their session.

Fixed by passing oldAccessToken instead:

refreshToken, tokenType, err := a.getRefreshTokenForAccessToken(ctx, oldAccessToken)

Verification

go build ./... clean.
go test ./domains/authentication/... ./domains/accounts/... ./domains/raw_events/... — all pass, no regressions.
No new automated regression test for this specific bug: RefreshAccessToken calls a.TokenSource(...).Token(), which makes a real network call to Auth0 to redeem the refresh token - not mockable without adding an interface seam around oauth2.Config/oidc.Provider, which is a larger refactor than this fix warranted. The underlying query helper (getRefreshTokenForAccessToken) is already covered indirectly via domains/authentication/dev_test.go.

Follow-ups / not done here

If this path matters enough to regression-test end-to-end, it'd need oauth2.Config's token source made injectable/mockable - flagging as a possible future task, not doing it now.

1.7 KiB Raw Blame History