Clear refresh token expiry when the token is rotated

A refresh response that issues a new refresh_token without
refresh_token_expires_in no longer inherits the previous token's
lifetime. That leftover expiry could make a still-valid session look
expired and force another hx auth login.

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/control_auth.py

@@ -644,6 +644,13 @@ def _build_refreshed_oauth_session(
             details=payload,
         )
 
+    previous_refresh_token = _normalize_text(previous.get("refresh_token"))
+    refresh_token = (
+        _normalize_text(payload.get("refresh_token")) or previous_refresh_token
+    )
+    refresh_token_expiry = _derive_expiry(payload.get("refresh_token_expires_in"))
+    if refresh_token_expiry is None and refresh_token == previous_refresh_token:
+        refresh_token_expiry = _normalize_text(previous.get("refresh_token_expiry"))
     return {
         "version": previous.get("version", 1),
         "base_url": _normalize_base_url(previous.get("base_url")),
@@ -652,13 +659,11 @@ def _build_refreshed_oauth_session(
         or _normalize_text(previous.get("token_type"))
         or "Bearer",
         "access_token": access_token,
-        "refresh_token": _normalize_text(payload.get("refresh_token"))
-        or _normalize_text(previous.get("refresh_token")),
+        "refresh_token": refresh_token,
         "expiry": _derive_expiry(payload.get("expires_in")) or "",
         "scope": _normalize_text(payload.get("scope"))
         or _normalize_text(previous.get("scope")),
-        "refresh_token_expiry": _derive_expiry(payload.get("refresh_token_expires_in"))
-        or _normalize_text(previous.get("refresh_token_expiry")),
+        "refresh_token_expiry": refresh_token_expiry or "",
     }
 
 

tests/test_control_auth.py

@@ -479,6 +479,108 @@ def handler(request: httpx.Request) -> httpx.Response:
     assert headers_again == {"authorization": "Bearer no-expiry-access"}
 
 
+def test_rotated_refresh_token_without_expires_in_clears_old_expiry(
+    auth_home, monkeypatch
+):
+    old_refresh_expiry = _expiry(minutes=1)
+    write_session(
+        auth_home,
+        access_token="expired-access",
+        expiry=_expiry(minutes=-5),
+        refresh_token="old-refresh",
+        refresh_token_expiry=old_refresh_expiry,
+    )
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={
+                "access_token": "rotated-access",
+                "refresh_token": "rotated-refresh",
+                "expires_in": 3600,
+            },
+        )
+
+    _patch_httpx_client(monkeypatch, handler)
+    _, auth = resolve_control_plane_config(ClientConfig())
+    headers, token = auth.authorize_headers()
+    assert headers == {"authorization": "Bearer rotated-access"}
+    assert token == "rotated-access"
+
+    saved = json.loads(
+        (Path(auth_home) / ".hx_config" / "auth" / "default.json").read_text()
+    )
+    assert saved["refresh_token"] == "rotated-refresh"
+    assert saved["refresh_token_expiry"] == ""
+    assert saved["refresh_token_expiry"] != old_refresh_expiry
+
+
+def test_reused_refresh_token_without_expires_in_keeps_old_expiry(
+    auth_home, monkeypatch
+):
+    old_refresh_expiry = _expiry(hours=2)
+    write_session(
+        auth_home,
+        access_token="expired-access",
+        expiry=_expiry(minutes=-5),
+        refresh_token="same-refresh",
+        refresh_token_expiry=old_refresh_expiry,
+    )
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={
+                "access_token": "refreshed-access",
+                "expires_in": 3600,
+            },
+        )
+
+    _patch_httpx_client(monkeypatch, handler)
+    _, auth = resolve_control_plane_config(ClientConfig())
+    auth.authorize_headers()
+
+    saved = json.loads(
+        (Path(auth_home) / ".hx_config" / "auth" / "default.json").read_text()
+    )
+    assert saved["refresh_token"] == "same-refresh"
+    assert saved["refresh_token_expiry"] == old_refresh_expiry
+
+
+def test_rotated_refresh_token_uses_new_expires_in(auth_home, monkeypatch):
+    old_refresh_expiry = _expiry(minutes=1)
+    write_session(
+        auth_home,
+        access_token="expired-access",
+        expiry=_expiry(minutes=-5),
+        refresh_token="old-refresh",
+        refresh_token_expiry=old_refresh_expiry,
+    )
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={
+                "access_token": "rotated-access",
+                "refresh_token": "rotated-refresh",
+                "expires_in": 3600,
+                "refresh_token_expires_in": 7200,
+            },
+        )
+
+    _patch_httpx_client(monkeypatch, handler)
+    _, auth = resolve_control_plane_config(ClientConfig())
+    auth.authorize_headers()
+
+    saved = json.loads(
+        (Path(auth_home) / ".hx_config" / "auth" / "default.json").read_text()
+    )
+    assert saved["refresh_token"] == "rotated-refresh"
+    assert saved["refresh_token_expiry"] != old_refresh_expiry
+    assert saved["refresh_token_expiry"] != ""
+    assert _parse_timestamp(saved["refresh_token_expiry"]) is not None
+
+
 def test_parse_timestamp_accepts_variable_fractional_seconds():
     assert _parse_timestamp("2026-08-15T12:00:00Z") is not None
     assert _parse_timestamp("2026-08-15T12:00:00.1Z") is not None