feat(auth): handle refresh token #67
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR implements comprehensive OIDC authentication with automatic token refresh functionality using Better Auth. The implementation adds encrypted token storage in HTTP-only cookies, automatic access token refresh when expired, and a dedicated refresh endpoint.
Key changes:
- Custom token management with AES-256-GCM encryption for access and refresh tokens
- Automatic token refresh flow via
/api/auth/refresh-tokenendpoint - Server-side authenticated API client with transparent token handling
- Database hooks to persist tokens on both initial login and re-login flows
Reviewed Changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated 14 comments.
Show a summary per file
| File | Description |
|---|---|
src/lib/auth/types.ts |
New TypeScript interfaces for OIDC token data and responses |
src/lib/auth/utils.ts |
Encryption/decryption utilities using JWE with type guards |
src/lib/auth/constants.ts |
Centralized auth configuration and environment variables |
src/lib/auth/auth.ts |
Core auth logic including Better Auth config, token refresh, and cookie management |
src/lib/auth/token.ts |
Token retrieval and refresh orchestration server actions |
src/lib/auth/README.md |
Comprehensive architecture documentation with flow diagrams |
src/app/api/auth/refresh-token/route.ts |
API route handler for token refresh requests |
src/lib/api-client.ts |
Authenticated API client factory with automatic token injection |
src/app/catalog/actions.ts |
Updated to use authenticated client |
src/app/layout.tsx |
Removed unnecessary api-client import |
src/lib/auth/__tests__/auth.test.ts |
Updated tests for token management without cookie deletion |
src/lib/auth/__tests__/token.test.ts |
Comprehensive test suite for token refresh flows |
vitest.config.mts |
Added OIDC_PROVIDER_ID environment variable for tests |
src/mocks/server.ts |
Removed biome-ignore comments (now handled by config) |
src/mocks/mocker.ts |
Code formatting improvements for long strings |
biome.json |
Updated schema version and disabled console warnings for mocks |
dev-auth/README.md |
Updated environment variable documentation |
CLAUDE.md |
Added detailed auth environment variable documentation |
AGENTS.md |
Added auth configuration details for AI agents |
- Add Better Auth with OIDC (OAuth2 Authorization Code Flow) - Implement custom token storage in encrypted HTTP-only cookies - Add automatic access token refresh when expired - Create dedicated /api/auth/refresh-token endpoint - Fix race condition by creating new client instance per request - Add fail-fast validation for API_BASE_URL env var - Add refresh token expiration check before API call - Add warning when provider doesn't return new refresh token - Add account.update.after hook for re-login flow - Add comprehensive auth documentation in src/lib/auth/README.md - Add 22 unit tests for auth flows Security improvements: - AES-256-GCM encryption for token storage - Server-side only API client (no token exposure to client) - HTTP-only cookies (not accessible via JavaScript) - SameSite protection - 7-day session management with Better Auth cookie cache Fixes #50
kantord
approved these changes
Nov 21, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Authentication Implementation
Kapture.2025-11-20.at.18.32.32.mp4
Implemented OIDC authentication with Better Auth and custom token management:
Key Features:
/api/auth/refresh-tokenendpoint for token refreshSee
src/lib/auth/README.mdfor detailed architecture and flow diagrams.Refresh token
Authentication flow