fix(auth): end sessions the server has rejected (auth-public-client ^0.6.0)

[interacsean]

What

Raises @tailor-platform/auth-public-client from ^0.5.1 to ^0.6.0, so a session the server has refused is torn down instead of replayed forever.

Why

On 0.5.x an expired or revoked grant left isAuthenticated true and reattached the dead token to every request. Apps sat in a permanent {"errors":[{"message":"unauthorized","type":"Gateway"}]} loop that only a manual IndexedDB clear recovered from. Two paths kept the dead session alive: rejection was recognised only by three literal error codes (so a WWW-Authenticate challenge, which carries no .error, was missed entirely), and the proactive refresh flattened the rejection to null before any code could act on it.

^0.5.1 does not span 0.6.0, so consumers do not pick this up automatically — the pin is the delivery mechanism.

No source change was needed — verified, not assumed

Reading 0.6.0's shipped code rather than trusting the release notes:

• logoutImpl emits logout then auth_state_changed.
• resetState leaves isReady: true with isAuthenticated: false.

That is exactly the shape attemptAutoLogin gates on (packages/core/src/contexts/auth-context.tsx), so the fix reaches consumers through the subscription already in place. A .d.ts diff of 0.5.1 → 0.6.0 confirms the type surface is purely additive: one new export (getValidAccessTokenOrThrow), AuthClient unchanged.

Transient failures are unaffected — a 5xx, a timeout, and a network failure all still leave the session intact.

Consumer-visible behaviour change

fetch and getAuthHeaders no longer throw Error("No valid access token") on a rejected refresh; they throw the underlying error. Apps that detected dead sessions by matching that message have silently stopped detecting them and should listen for logout / auth_state_changed instead. Called out in the changeset.

Grepping the installed package for that string does not tell you whether you are affected — the throw survives for the genuinely-no-token case, so the grep passes either way.

Changes

• packages/core/package.json — ^0.5.1 → ^0.6.0 (+ lockfile; includes a no-op pnpm reorder of @microsoft/api-extractor, same specifier and version)
• packages/core/src/contexts/auth-context.test.tsx — regression test that the 0.6.0 teardown sequence (logout immediately followed by auth_state_changed) yields exactly one login redirect, not two
• docs/concepts/authentication.md — new "Session expiry" section; corrects three places that described fetch as handling refresh but not rejection
• .changeset/ — patch

@tailor-platform/auth-public-client is permanently exempt from the repo's minimumReleaseAge gate (pnpm-workspace.yaml), so the 9-day-old release installs cleanly in CI.

Testing

• build, type-check, lint, fmt:check pass; 1580 tests pass
• Both example apps boot clean — all requests 200, no console or server errors

Not verified here: the original deadlock cannot be reproduced in this repo — it needs a real expired or revoked refresh token against a live workspace, and app-shell has none. The browser check proves the dependency loads and integrates, not that the deadlock is gone. End-to-end confirmation has to come from a consuming app; Denim Tears is the natural candidate, and its app-side mitigation (tailor-professional-service/denim-tears#1479) should become removable once this ships.

Not done

getValidAccessTokenOrThrow is not re-exported. app-shell exposes no auth utils today, only the AuthClient type — adding one is an API design decision rather than part of a dependency bump. Happy to add it if wanted.

References

• Tracking: board draft (draft issue, no number yet)
• Release notes: https://github.com/tailor-platform/auth-public-client/releases/tag/v0.6.0
• Upstream bug: tailor-platform/auth-public-client#113, fix tailor-platform/auth-public-client#129
• Original report: tailor-inc/platform-planning#1495
• Server-side counterpart (non-RFC 401 on expired refresh token): tailor-inc/platform-core-services#12840
• Prior art: fix(deps): raise auth-public-client floor to ^0.5.1 #383 (previous floor raise, also fix(deps))

🤖 Generated with Claude Code

[interacsean]

/review

[github-actions]

✅ Code Review completed successfully!

Code review complete — no issues found. PR #467 is a clean dependency bump of @tailor-platform/auth-public-client from ^0.5.1 to ^0.6.0. The existing auth_state_changed subscription integrates correctly with the 0.6.0 teardown sequence, the regression test is valid, and the behavior change is properly documented. Verdict: Approve.

[github-actions]

Code Metrics Report

	main (41ae0e3)	#467 (6c3cac1)	+/-
Coverage	90.1%	90.1%	0.0%
Test Execution Time	2m5s	1m59s	-6s

Details

  |                     | main (41ae0e3) | #467 (6c3cac1) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |          90.1% |          90.1% | 0.0% |
  |   Files             |            152 |            152 |    0 |
  |   Lines             |           5201 |           5201 |    0 |
  |   Covered           |           4690 |           4690 |    0 |
+ | Test Execution Time |           2m5s |          1m59s |  -6s |

Code coverage of files in pull request scope (0.0% → 0.0%)

Files	Coverage	+/-	Status
packages/core/package.json	0.0%	0.0%	modified

---

Reported by octocov