Force Refresh Access Token Enhancements #2164
Conversation
…Add GetAccessTokenOptions type with refresh parameter to client-side getAccessToken - Update server-side handleAccessToken to support refresh query parameter - Add comprehensive unit tests for force refresh functionality - Add E2E tests with force refresh buttons for both app and pages router - Update EXAMPLES.md with comprehensive client and server-side force refresh examples - Maintain backward compatibility with existing getAccessToken usage - Add proper TypeScript overloads and JSDoc documentation
tusharpandey13
changed the title
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2164 +/- ##
==========================================
- Coverage 82.61% 82.21% -0.40%
==========================================
Files 21 21
Lines 2042 2058 +16
Branches 358 359 +1
==========================================
+ Hits 1687 1692 +5
- Misses 348 359 +11
Partials 7 7 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| /** | ||
| * Retrieves an access token from the `/auth/access-token` endpoint. | ||
| * | ||
| * @returns The access token string. | ||
| * @throws {AccessTokenError} If there's an error retrieving the access token. | ||
| */ | ||
| export async function getAccessToken(): Promise<string>; | ||
|
|
||
| /** | ||
| * Retrieves an access token from the `/auth/access-token` endpoint. | ||
| * | ||
| * @param options Configuration for getting the access token. | ||
| * @returns The access token string. | ||
| * @throws {AccessTokenError} If there's an error retrieving the access token. | ||
| */ | ||
| export async function getAccessToken( | ||
| options: GetAccessTokenOptions | ||
| ): Promise<string>; |
There was a problem hiding this comment.
Why do we need these overloads?
There was a problem hiding this comment.
To adhere to a no-contract change (adding new overloads)
There was a problem hiding this comment.
We do not need those. We can just keep the one we have where options is marked optional, there is no point to the overloads here.
| if (!this.enableAccessTokenEndpoint) { | ||
| return new NextResponse("Not Found", { | ||
| status: 404 | ||
| }); | ||
| } |
There was a problem hiding this comment.
How does this relate to the PR scope?
|
I would also propose to change the PR title to be: |
Co-authored-by: Frederik Prijck <[email protected]>
There was a problem hiding this comment.
I don't think it's the right move to allow the untrusted client to dictate whether the AT should be refreshed. I would lean towards this being a server-side configuration option on the auth0 client (e.g.: alwaysRefreshTokenSet).
Are we trying to solve a particular problem that can't be addressed by making this a server-side configuration option?
Uh oh!
There was an error while loading. Please reload this page.