fix(auth): deactivate account on refresh-time token_expired

[Soju06]

Fixes #383.

Root cause

When the OAuth refresh endpoint returns error code token_expired (HTTP 401 body {"error": {"code": "token_expired"}} with message "Provided authentication token is expired. Please try signing in again."), the existing code path treats it as a transient failure:

• PERMANENT_FAILURE_CODES in app/core/balancer/logic.py only lists refresh_token_expired, refresh_token_reused, refresh_token_invalidated, account_deactivated, account_suspended, account_deleted. It does not include token_expired.
• classify_refresh_error("token_expired") therefore returns False, so RefreshError is built with is_permanent=False.
• AuthManager.refresh_account only deactivates on a permanent error.
• usage._should_deactivate_for_usage_error only deactivates on HTTP 402/404, on the existing permanent code set, or on the "account has been deactivated" message hint.

Net effect: refresh keeps failing, the account stays ACTIVE, and the load balancer keeps selecting it. The reporter ran into exactly this with email_3e2ba4c18bda until they manually paused it.

Why token_expired at the refresh boundary is permanent

This is not a transient error in practice:

• Access-token-only expiry would have caused the refresh call itself to return a fresh token pair (HTTP 200). The refresh wouldn't fail.
• A token_expired arriving at the refresh boundary means the refresh token (or the session it represents) is no longer usable.
• That is the same shape as refresh_token_expired / refresh_token_invalidated -- just a different error code on the upstream side.

So treating it as permanent matches what is actually happening on the upstream side, and matches the reporter's observation that the account only recovers after re-authentication.

Fix

Add token_expired to PERMANENT_FAILURE_CODES with the message "Authentication token expired - re-login required". This single change flows through both deactivation paths without further plumbing:

• AuthManager.refresh_account -- via classify_refresh_error("token_expired") -> True
• usage-refresh _should_deactivate_for_usage_error -- via its code in PERMANENT_FAILURE_CODES check

So a refresh-time token_expired now correctly deactivates the account on both the request-driven refresh path and the background usage refresh path. The reporter's affected account would now be deactivated on the next failing refresh and stop draining client requests.

Re-authentication clears the deactivation as it does today for the other permanent codes.

Tests

tests/unit/test_auth_refresh.py::test_classify_refresh_error_token_expired_is_permanent PASSED
tests/unit/test_auth_manager.py::test_refresh_account_deactivates_when_upstream_returns_token_expired PASSED

The auth-manager regression test drives refresh_account against a stubbed refresh_access_token raising RefreshError("token_expired", ..., classify_refresh_error("token_expired")), then asserts:

• the resulting RefreshError has is_permanent=True and code="token_expired"
• the account row is updated to AccountStatus.DEACTIVATED
• the deactivation reason surfaces the re-login / expired wording

Verification on this branch:

uv run ruff check app/core/balancer/logic.py tests/unit/test_auth_refresh.py tests/unit/test_auth_manager.py     # clean
uv run ruff format --check app/core/balancer/logic.py tests/unit/test_auth_refresh.py tests/unit/test_auth_manager.py  # clean
uv run ty check app/core/balancer/logic.py tests/unit/test_auth_refresh.py tests/unit/test_auth_manager.py        # clean
uv run pytest tests/unit/test_auth_refresh.py tests/unit/test_auth_manager.py tests/unit/test_load_balancer.py -q   # 74 passed
npx @fission-ai/openspec validate deactivate-on-token-expired                                                       # change is valid

OpenSpec

Added openspec/changes/deactivate-on-token-expired/ capturing the new behavior under the existing usage-refresh-policy capability (refresh-time and usage-refresh-time token_expired both deactivate; classification scenario; deactivation scenario; reason wording requirement).

Hotfix candidate for v1.17.1 / v1.17.2

Small, scoped change to the permanent-failure classification, with two unit regressions and an OpenSpec entry. No runtime/migration impact. Pairs naturally with #598 (the bcrypt 72-byte fix) for the next patch release.

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".