Repository navigation
Conversation
The SDK refreshes the token on code 40 only. A token used before its issue date (42) is reconnected as-is until the server's clock catches up, and a bad signature (43) is not retried with a new token. The four tests now assert that instead of a refresh. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
|
Keep the invalid window open past the refresh so the refreshed token is always rejected, count token requests through an env assertion, and fix the step and file comments to match what the tests assert. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A signing secret doesn't go bad mid-session, and the test only timed the SDK's reconnect backoff. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The chooser page is replaced while connecting, so an error it stored itself was gone by the time the login failed. The auth state now carries it, and the rebuilt page shows it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012vTgFwqhUc2wKCWrw635yC
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The "token date / signature invalidates" e2e tests expected the app to fetch a new token. Three now assert what the SDK does on purpose:
"token signature invalidates after the user logs in" is removed: a signing secret doesn't go bad mid-session, and the test only timed the SDK's reconnect backoff (about a minute of CI). The env now has
assertTokenRequests.UserRobot.assertLoginFailedchecks the error the chooser shows.Why
FLU-1083 asked for a refresh on 41–43. The SDK refreshes on 40 only, and so do iOS, JS and the v11 core (
stream_coreauth_interceptor.dart,stream_error_code.dart). The backend parses JWTs with no leeway, so 41/42 are clock skew: the same token passes once the server's clock catches up, and a new token from the same issuer would be just as early. 43 is a signing-secret mismatch that no refresh fixes.The 42-after-login test needs mock-server#95. Until then the mock keeps answering 42 until a new token is fetched, which the real backend doesn't do.
Verification
dart analyzeone2e_app. The two un-skipped tests run in this PR's E2E workflow.🤖 Generated with Claude Code