fix(auth): refresh on 401 and stop writing bogus refresh tokens

[brycelelbach]

Problem

Users report being logged out of brev-cli multiple times per hour, forcing repeated brev login --token $TOKEN. Two independent bugs in the auth flow combined to produce this.

Bug 1: LoginWithToken writes a bogus refresh token

pkg/auth/auth.go LoginWithToken (before this PR):

if valid {
    err := t.authStore.SaveAuthTokens(entity.AuthTokens{
        AccessToken:  token,
        RefreshToken: "auto-login",   // <- literal string, not a token
    })
}

When a user runs brev login --token $JWT (e.g. the snippet from https://brev.nvidia.com/settings/cli), the CLI saves the JWT as the access token and the literal string "auto-login" as the refresh token.

Later, when the short-lived access token expires, GetFreshAccessTokenOrNil sees RefreshToken != "" and calls oauth.GetNewAuthTokensWithRefresh("auto-login"). That always fails (the IdP doesn’t recognize the sentinel), so the user is bumped back to re-login. With typical NVIDIA KAS access-token TTLs, that happens roughly hourly.

Bug 2: auth-failure retry only fires on 403, not 401

pkg/store/http.go SetForbiddenStatusRetryHandler (before this PR) installed a refresh-and-retry handler that only triggered on http.StatusForbidden (403). APIs returning 401 Unauthorized — the more standard response for expired credentials — bypassed the hook entirely and surfaced as a hard failure on the first such response, even when the refresh token was still valid.

Fix

pkg/auth/auth.go

• LoginWithToken no longer writes "auto-login" as the refresh token for JWT input. It stores an empty RefreshToken and prints a one-line notice on stderr so the user knows the session will not auto-renew.
• GetFreshAccessTokenOrNil normalizes the legacy "auto-login" sentinel to "" on read, so existing ~/.brev/credentials.json files from older CLI versions benefit from the fix without re-running brev login --token.
• When the access token is expired and there is no refresh token, GetFreshAccessTokenOrNil now returns "" instead of the expired JWT. Callers prompt for re-login cleanly instead of shipping a doomed request.

pkg/store/http.go

• The refresh-and-retry handler now fires on both 401 and 403, via a small isAuthFailure(code int) bool helper. The public function name (SetForbiddenStatusRetryHandler) is left unchanged to avoid touching callers; the comment on isAuthFailure documents the broadened semantics.

What this does and does not fix

Fixes: the hourly logout loop caused by the bogus-refresh + JWT-expiry interaction, and unhandled 401s that skipped the refresh path.

Does not fix: brev login --token still produces a non-refreshable session, because the website currently hands out a raw access JWT rather than a refresh token. Step 2 of the larger plan is a server-side change to brev.nvidia.com/settings/cli so it issues a refresh token (or a short-lived exchange code) that the CLI can swap for {access, refresh}. That is out of scope for this PR.

Test plan

• go build ./...
• go vet ./pkg/store/... ./pkg/auth/...
• go test ./pkg/auth/...
• Manual: brev login --token $JWT, wait for the access token to expire, verify the CLI prompts for re-login once (not per-call) and that subsequent calls with a real {access, refresh} pair auto-refresh without re-prompting.
• Manual: verify that an API call returning 401 now triggers the refresh handler and retries once, rather than failing immediately.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes brev-cli auth churn by preventing invalid refresh-token storage during brev login --token and ensuring auth refresh/retry triggers on both 401 and 403 responses.

Changes:

• Stop writing the legacy "auto-login" string as a refresh token; treat it as absent when reading existing credentials.
• Update access-token retrieval to return "" (no token) when an access token is invalid/expired and no refresh token is available.
• Broaden the HTTP refresh-and-retry hook to trigger on both 401 Unauthorized and 403 Forbidden.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/store/http.go	Expands auth-failure detection (401/403) for refresh-and-retry behavior via isAuthFailure.
pkg/auth/auth.go	Removes bogus refresh-token writes, normalizes legacy sentinel on read, and avoids returning expired/invalid access tokens without refresh.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This change broadens the retry/refresh behavior to include 401 responses, but pkg/store/http_test.go currently only exercises the 403 path. Add a unit test covering 401 to ensure the handler runs and the request retries as expected.

[Copilot]

GetFreshAccessTokenOrNil now (1) treats the legacy refresh-token sentinel "auto-login" as absent and (2) returns an empty token when the access token is invalid/expired and no refresh token is available. Please add/adjust unit tests in pkg/auth/auth_test.go to cover these new branches so regressions don't reintroduce the logout loop.