Implement session token refresh #71

New issue

Open

opened 2026-03-03 15:18:21 -08:00 by fable · 0 comments

fable commented

2026-03-03 15:18:21 -08:00

Contributor

Add a RefreshSession RPC to AuthService that:

Accepts the current (possibly-expired) microclimate JWT
Verifies it was validly issued by this server (signature check, ignoring expiry)
Looks up the corresponding OAuthSession in the auth store by DID
Issues a fresh JWT with a new 24-hour expiry

The client should call this proactively before expiry (e.g. on app resume / reconnect).

Related to #9.

After a successful ATProto OAuth login, we discard the ATProto tokens and rely exclusively on the microclimate JWT for authentication. That JWT expires after 24 hours, so the client needs a way to renew it without repeating the full browser-based OAuth flow. Add a `RefreshSession` RPC to `AuthService` that: - Accepts the current (possibly-expired) microclimate JWT - Verifies it was validly issued by this server (signature check, ignoring expiry) - Looks up the corresponding `OAuthSession` in the auth store by DID - Issues a fresh JWT with a new 24-hour expiry The client should call this proactively before expiry (e.g. on app resume / reconnect). Related to #9.