Repository navigation
Clear rejected OAuth refresh tokens; keep expected Better Auth 4xx out of error telemetry - #226
Merged
Merged
Conversation
…h 4xx out of error telemetry
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Queued CLI processes can still replay cleared refresh tokens through their stale credential fallback.
1 open issue
What changed in this PR
This minimal replacement for #225 addresses rejected OAuth refresh tokens in the CLI and expected client-error telemetry from Better Auth.
Changes:
- Clear rejected stored tokens and serialize login persistence with refresh operations.
- Suppress exception events and ERROR status for Better Auth 4xx spans.
- Add refresh-failure and span-classification tests.
| File | Description |
|---|---|
| packages/server/telemetry.ts | Registers the span processor. |
| packages/server/auth/client-error-spans.ts | Filters Better Auth 4xx error telemetry. |
| packages/server/auth/client-error-spans.test.ts | Tests error classification and scope isolation. |
| packages/cli/session.ts | Clears rejected refresh credentials. |
| packages/cli/session.test.ts | Tests rejection cleanup and transient failures. |
| packages/cli/commands/login.ts | Stores login tokens under the refresh lock. |
Review effort: Balanced
| const refreshToken = current.refresh_token ?? fallback.refresh_token; | ||
| if (!refreshToken) return undefined; | ||
| return doRefresh(server, refreshToken, current); | ||
| if (!current.refresh_token) return undefined; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Minimal replacement for #225.
Problem
invalid_grant), the CLI keeps it stored, so every later call (and every process) replays it.Changes
packages/cli/session.ts: in the existinginvalid_grantbranch (already under the refresh lock), if the store still holds the rejected token, clear it. The next call makes no network request and gets the existing "Session expired. Run 'me login'" message.packages/cli/commands/login.ts: persist login tokens under the samewithRefreshLock, so a concurrent rejection clear can't wipe a fresh login.packages/server/auth/client-error-spans.ts: span processor (registered intelemetry.ts) that, forbetter-authscope spans only, skips the exception event and ERROR status for 4xx errors, keepinghttp.response.status_code. 5xx, status-less errors and other scopes are unchanged.Known limits
recordExceptionthensetStatus; if that changes, spans go red again (never hides real errors).Validation
./bun run check(typecheck, lint, 1426 unit tests) passes.APIError4xx not red, 5xx/plain errors red, other scopes untouched.