Function refreshDeviceTokens

apps/cli/src/device-login.ts:331–361

(input: {
  readonly tokenEndpoint: string;
  readonly clientId: string;
  readonly refreshToken: string;
  readonly headers?: Readonly<Record<string, string>>;
  readonly serverOrigin?: string;
})

 * providers that issue refresh tokens reach here (WorkOS, which is form-encoded
 * per RFC 8628); Better Auth's device flow issues no refresh token. */
export const refreshDeviceTokens = async (input: {
  readonly tokenEndpoint: string;
  readonly clientId: string;
  readonly refreshToken: string;
  readonly headers?: Readonly<Record<string, string>>;
  readonly serverOrigin?: string;
}): Promise<DeviceTokens> => {
  const response = await post(
    input.tokenEndpoint,
    {
      grant_type: "refresh_token",
      refresh_token: input.refreshToken,
      client_id: input.clientId,
    },
    "form",
    input,
  );
  const body = await readJson(response);
  if (!response.ok) {
    throw new DeviceLoginError(
      `Token refresh failed: ${asString(body.error_description) ?? asString(body.error) ?? `HTTP ${response.status}`}`,
    );
  }
  const accessToken = asString(body.access_token);
  if (!accessToken) throw new DeviceLoginError("Refresh response was missing an access token.");
  return {
    accessToken,
    refreshToken: asString(body.refresh_token) ?? input.refreshToken,
    expiresAt: deriveExpiresAt({ accessToken, expiresIn: asNumber(body.expires_in) }),
  };
};

export type BrowserOpenCommand = readonly [command: string, args: ReadonlyArray<string>];