Function runRefresh

src/commands/oauth-refresh/oauth-refresh.ts:34–109

(context: Parameters<LocalCommandCall>[1])

}

async function runRefresh(context: Parameters<LocalCommandCall>[1]): Promise<string> {
  const authRuntime = getAuthRuntime()
  const session = await authRuntime.resolveSession({ allowRefresh: false })

  if (session.headersKind !== 'bearer' || !session.accessToken) {
    return 'Cannot refresh OAuth: no OAuth token is currently available.'
  }

  if (!session.refreshTokenPresent) {
    return [
      'Cannot refresh OAuth: current token has no refresh token.',
      `Source: ${session.rawAuthTokenSource ?? session.principalSource}`,
      'This usually means env/FD-provided service token auth, which is non-refreshable.',
    ].join('\n')
  }

  const refreshToken = authRuntime.getCurrentManagedRefreshToken()
  if (!refreshToken) {
    return 'Cannot refresh OAuth: refresh token is unavailable.'
  }

  const requestedScopes = getOAuthRefreshRequestedScopes(session)

  const before = {
    expiresAt: session.accessTokenExpiresAt,
    source: session.rawAuthTokenSource ?? session.principalSource,
  }

  const refreshed = await refreshOAuthToken(refreshToken, {
    scopes: requestedScopes,
  })
  const saveResult = authRuntime.persistOAuthTokensIfNeeded(refreshed)
  authRuntime.clearManagedTokenCache()

  if (!saveResult.success) {
    throw new Error(saveResult.warning ?? 'Failed to persist refreshed OAuth token')
  }

  let rolesRefreshNote = ''
  try {
    await fetchAndStoreUserRoles(refreshed.accessToken)
  } catch (error) {
    // Limited-scope tokens can fail role fetch; keep refresh successful.
    rolesRefreshNote = `\nRole refresh skipped: ${errorMessage(error)}`
    logForDebugging(`oauth-refresh roles update skipped: ${errorMessage(error)}`, {
      level: 'error',
    })
  }

  // Same post-auth cache refresh style used by other auth-changing flows.
  resetUserCache()
  refreshGrowthBookAfterAuthChange()
  void refreshPolicyLimits()
  void refreshRemoteManagedSettings()
  context.setAppState(prev => ({
    ...prev,
    authVersion: prev.authVersion + 1,
  }))