fix(oauth): harden refresh token refresh-response validation

2026-05-10 05:52:45 +00:00 · 2026-02-21 13:44:04 +01:00
parent 24d18d0d72
commit 6cb7e16d40
5 changed files with 93 additions and 6 deletions
--- a/src/agents/chutes-oauth.ts
+++ b/src/agents/chutes-oauth.ts
@@ -218,6 +218,7 @@ export async function refreshChutesTokens(params: {
  return {
    ...params.credential,
    access,
+    // RFC 6749 section 6: new refresh token is optional; if present, replace old.
    refresh: newRefresh || refreshToken,
    expires: coerceExpiresAt(expiresIn, now),
    clientId,