smcli self-healing sessions (refresh grant + auto-relogin) #4

2026-09-07T14:43:55Z

reachableceo commented

2026-09-07 14:43:55 +00:00

Fixes the credential-expiry complaints: refresh_token persisted+rotated (Vaultwarden semantics), 401 auto-refresh+retry, fallback full relogin via shim-injected TSGCOO credentials. QA: forced token corruption -> transparent recovery. no-CR (dev tooling). Ticket: https://projects.knownelement.com/issues/832

reachableceo added 2 commits 2026-09-07 14:43:55 +00:00

smcli: refresh-token support - sessions no longer die after ~1h e067eee330

The login grant requested offline_access but the issued refresh_token
was parsed and discarded: every access token died with the ~1h
Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until
a human re-logged in.

- persist refresh_token in state (0600, same file)
- add refresh grant (grant_type=refresh_token, rotated token saved)
- on 401 for authed calls: refresh once, retry the request
- persistTokens() keeps the rest of the state intact

Build verified in golang:1.23-alpine (vet + gofmt clean). After
deploy, one `sm login` issues a refresh token (~30d, rotated on use)
and sessions self-heal from then on.

smcli: self-healing sessions — refresh-token grant + auto-relogin

ci / vet (pull_request) Successful in 1m9s

Details

cf4094b9e4

Vault access tokens expire (~10min); consumers hit 401s after container
recreates. Now: refresh_token persisted at login and rotated on every
refresh (Vaultwarden semantics); 401 on an authed call refreshes once
and retries; if refresh is unavailable, full relogin (password+TOTP
injected by the sm shims from the TSGCOO vault-account env) is attempted
before failing. cmdLogin passes the TOTP seed again (regression).
QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end.
Ticket: https://projects.knownelement.com/issues/832

manager-tsg approved these changes

2026-09-07 14:43:56 +00:00

manager-tsg left a comment

manager-tsg secondary: merge.

reachableceo merged commit 653aefc25c into main

2026-09-07 14:43:57 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KNEL/KNELSecretsManager#4