Implement /auth/refresh endpoint #37

2026-08-19T22:16:14Z

coder-bot commented

2026-08-19 22:16:14 +00:00

POST /auth/refresh implemented and fully verified. The coder agent had actually finished the endpoint (JWT decode, DB lookup against refresh_tokens, expiry + is_active checks, new access token issuance) before stalling on 3 empty turns -- its own blocker_reason self-report was stale/inaccurate, the code was essentially complete.

Ran the real backend against a fresh Postgres with real migrations applied and found two genuine bugs while verifying, both fixed:

auth.py: _create_access_token had no jti claim, so two /refresh calls within the same wall-clock second minted byte-identical access tokens (same failure mode already fixed for refresh tokens earlier this session) -- added jti to match
test_refresh_endpoint.py: its usernames (jwttoken, refreshuser, etc.) collided with test_auth_endpoints.py's own usernames once run in the same pytest session against a shared DB -- exactly how run_checkpoint_tests.py invokes pytest (no path filter, one shared DB, no per-test isolation). Namespaced this file's usernames with a refep_ prefix.

Full backend suite verified clean: 63/63 tests pass in one pytest run against a real Postgres.

POST /auth/refresh implemented and fully verified. The coder agent had actually finished the endpoint (JWT decode, DB lookup against refresh_tokens, expiry + is_active checks, new access token issuance) before stalling on 3 empty turns -- its own blocker_reason self-report was stale/inaccurate, the code was essentially complete. Ran the real backend against a fresh Postgres with real migrations applied and found two genuine bugs while verifying, both fixed: - auth.py: _create_access_token had no jti claim, so two /refresh calls within the same wall-clock second minted byte-identical access tokens (same failure mode already fixed for refresh tokens earlier this session) -- added jti to match - test_refresh_endpoint.py: its usernames (jwttoken, refreshuser, etc.) collided with test_auth_endpoints.py's own usernames once run in the same pytest session against a shared DB -- exactly how run_checkpoint_tests.py invokes pytest (no path filter, one shared DB, no per-test isolation). Namespaced this file's usernames with a refep_ prefix. Full backend suite verified clean: 63/63 tests pass in one pytest run against a real Postgres.

coder-bot added 3 commits 2026-08-19 22:16:14 +00:00

WIP checkpoint: Implement /auth/refresh endpoint b3d2d71789

WIP checkpoint: Implement /auth/refresh endpoint 3e81d60268

Fix access token collision and cross-file username collision 3cb4d01073

- auth.py: _create_access_token had no jti claim, so two refreshes
  within the same wall-clock second produced byte-identical access
  tokens (same failure mode already fixed for refresh tokens earlier)
- test_refresh_endpoint.py: usernames (jwttoken, refreshuser, etc.)
  collided with test_auth_endpoints.py's own test usernames once run
  in the same pytest session against a shared DB with no per-test
  isolation -- exactly how run_checkpoint_tests.py invokes pytest.
  Namespaced this file's usernames with a refep_ prefix.

Full backend suite (63 tests) passes clean end-to-end against a real
Postgres with real migrations applied.

reviewer-bot merged commit 5c21e5051c into main

2026-08-19 22:39:43 +00:00

coder-bot referenced this issue from a commit

2026-08-19 23:12:11 +00:00

Merge origin/main into agent/1de295a0da42

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: daddy/modbison#37