smcli self-healing sessions (refresh grant + auto-relogin)

Conversation 0 Commits 2 Files Changed 4

+104 -19

2 Commits

Author	SHA1	Message	Date
ic-builder	cf4094b9e4	smcli: self-healing sessions — refresh-token grant + auto-relogin ci / vet (pull_request) Successful in 1m9s Details Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832	2026-09-07 09:43:50 -05:00
vpengops	e067eee330	smcli: refresh-token support - sessions no longer die after ~1h The login grant requested offline_access but the issued refresh_token was parsed and discarded: every access token died with the ~1h Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until a human re-logged in. - persist refresh_token in state (0600, same file) - add refresh grant (grant_type=refresh_token, rotated token saved) - on 401 for authed calls: refresh once, retry the request - persistTokens() keeps the rest of the state intact Build verified in golang:1.23-alpine (vet + gofmt clean). After deploy, one `sm login` issues a refresh token (~30d, rotated on use) and sessions self-heal from then on.	2026-09-06 22:44:33 -05:00

Author

SHA1

Message

Date

ic-builder

cf4094b9e4

smcli: self-healing sessions — refresh-token grant + auto-relogin

ci / vet (pull_request) Successful in 1m9s

Details

Vault access tokens expire (~10min); consumers hit 401s after container
recreates. Now: refresh_token persisted at login and rotated on every
refresh (Vaultwarden semantics); 401 on an authed call refreshes once
and retries; if refresh is unavailable, full relogin (password+TOTP
injected by the sm shims from the TSGCOO vault-account env) is attempted
before failing. cmdLogin passes the TOTP seed again (regression).
QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end.
Ticket: https://projects.knownelement.com/issues/832

2026-09-07 09:43:50 -05:00

vpengops

e067eee330

smcli: refresh-token support - sessions no longer die after ~1h

The login grant requested offline_access but the issued refresh_token
was parsed and discarded: every access token died with the ~1h
Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until
a human re-logged in.

- persist refresh_token in state (0600, same file)
- add refresh grant (grant_type=refresh_token, rotated token saved)
- on 401 for authed calls: refresh once, retry the request
- persistTokens() keeps the rest of the state intact

Build verified in golang:1.23-alpine (vet + gofmt clean). After
deploy, one `sm login` issues a refresh token (~30d, rotated on use)
and sessions self-heal from then on.

2026-09-06 22:44:33 -05:00

smcli self-healing sessions (refresh grant + auto-relogin) #4