Skip to content

v0.6.1 — Reactive token refresh

Choose a tag to compare

View all tags
@hardbyte hardbyte released this 16 Jul 20:44
· 25 commits to main since this release
v0.6.1
9b4a02e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes

Replaces the proactive per-call token-expiry checks with reactive 401 recovery (#112, first step toward #113):

  • API methods only ensure the client holds tokens; no per-call JWT decodes or debug log spam
  • A 401 response triggers a single-flight token refresh and the request is retried — concurrent requests that failed with the same stale token share one refresh
  • More correct as well as simpler: a token revoked server-side is now refreshed and retried, where previously the local-clock check refused to refresh it
  • Sessions without a refresh token fall back to password re-auth; persistent 401s surface as NotAuthorizedException
Assets 2
Loading