fix: force token refresh and clear cookies on failure to avoid logout loop

[peppescg]

Summary

When a user's access token expires, the Cloud UI gets stuck in a redirect loop between /catalog and /api/auth/token-refresh — eventually hitting Firefox's "page isn't redirecting properly" error — instead of being cleanly logged out and bounced to /signin. Reported on staging; logs show [API Client] token near expiry, redirecting to token-refresh | path=/catalog repeating.

Root cause

The route handler called auth.api.getAccessToken, which only triggers a real refresh when the token has <5s left (Better Auth's internal threshold). The caller's near-expiry margin (isTokenNearExpiry) fires at <10s. In the 5–10s window:

1. /catalog → isTokenNearExpiry = true → redirect to /api/auth/token-refresh
2. Route handler → getAccessToken → 8s > 5s → returns 200 OK with no Set-Cookie (no refresh happened)
3. Browser redirected back to /catalog with unchanged cookie → loop until the browser bails out

Independently, when the refresh fails irrecoverably (e.g. refresh token revoked at the provider), the !ok → /signin branch left session_token and account_data cookies in place. The user could navigate back to /catalog and re-enter the loop because isTokenNearExpiry would still be true.

Fix

• Switched to auth.api.refreshToken (unconditional refresh) — eliminates the 5–10s race window. If we redirected here, we actually refresh.
• On any refresh failure, call auth.api.signOut({ asResponse: true }) and forward its Set-Cookie headers onto the /signin redirect, so session_token and account_data are genuinely cleared.
• Export the handler as both GET and POST: Next.js redirect() is 307 (method-preserving) outside Server Actions, so a redirect originating from a Server Action POST reaches this route as POST and would otherwise 405.

Test plan

• pnpm test src/app/api/auth/token-refresh/route.test.ts — 14/14 pass (new tests for failure-cleanup, signOut-failure resilience, and GET/POST parity)
• pnpm test src/lib/auth src/app/api/auth — 50/50 pass
• pnpm type-check — clean
• pnpm lint — clean for changed files
• Manual: let token expire on staging deploy, confirm redirect to /signin without loop
• Manual: clear refresh token at provider, confirm clean logout instead of loop

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes an auth redirect loop when access tokens are near expiry by ensuring the /api/auth/token-refresh route handler performs an unconditional refresh and performs a full cookie cleanup on refresh failures, preventing users from getting stuck bouncing between /catalog and the refresh endpoint.

Changes:

• Switch token refresh logic from auth.api.getAccessToken to auth.api.refreshToken to avoid Better Auth’s internal refresh threshold race.
• On refresh failure/exception, call auth.api.signOut({ asResponse: true }) and forward its Set-Cookie headers onto the /signin redirect to clear auth cookies.
• Export both GET and POST handlers and add Vitest coverage for cookie-forwarding, failure cleanup, and method parity.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/app/api/auth/token-refresh/route.ts	Forces refresh, forwards Set-Cookie, adds sign-out cleanup on failure, and exports GET/POST.
src/app/api/auth/token-refresh/route.test.ts	Updates mocks and adds tests for refresh + cookie forwarding, cleanup behavior, and POST handler parity.

Comments suppressed due to low confidence (2)

src/app/api/auth/token-refresh/route.ts:67

• NextResponse.redirect() defaults to 307 (method-preserving). Since this handler is now callable via POST (per the PR description), a POST to /api/auth/token-refresh will be redirected back to safeRedirect with 307 and the browser will re-POST to /catalog (likely 405 / unintended). Consider returning 303 See Other (or conditional 303 for POST, 307 for GET) for redirects back to app pages.

This issue also appears on line 88 of the same file.

    const redirectResponse = NextResponse.redirect(
      new URL(safeRedirect, BASE_URL),
    );

src/app/api/auth/token-refresh/route.ts:93

• Same issue on the failure path: NextResponse.redirect(new URL("/signin", BASE_URL)) will be a 307 by default, so a POST refresh attempt could be redirected to /signin as a POST. Use 303 (or conditional based on request.method) to ensure the browser navigates to /signin with GET.

async function signOutAndRedirect(
  requestHeaders: Headers,
): Promise<NextResponse> {
  const response = NextResponse.redirect(new URL("/signin", BASE_URL));
  try {
    const signOutResponse = await auth.api.signOut({