bug: token endpoint not being called after expiring

.claude/settings.json

@@ -0,0 +1,5 @@
+{
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true
+  }
+}

extension/background.js

@@ -4,22 +4,42 @@
 const API_URL = 'https://api.tryhavril.com';
 
 async function getConfig() {
-  const session = await new Promise((r) =>
-    chrome.storage.session.get(['token', 'refreshToken'], r),
-  );
+  const [session, local] = await Promise.all([
+    new Promise((r) => chrome.storage.session.get(['token'], r)),
+    new Promise((r) => chrome.storage.local.get(['refreshToken'], r)),
+  ]);
   return {
     token: session.token || '',
+    refreshToken: local.refreshToken,
     serverUrl: API_URL,
   };
 }
 
-async function apiFetch(path, options = {}) {
+async function clearSession() {
+  await chrome.storage.session.remove(['token']);
+  await chrome.storage.local.remove(['refreshToken']);
+  await chrome.storage.sync.remove(['userName', 'userEmail', 'userAvatar']);
+}
+
+function authError() {
+  const e = new Error('Session expired — please sign in again');
+  e.code = 'auth_failed';
+  return e;
+}
+
+function notAuthError() {
+  const e = new Error('Not signed in — open the Havril extension to sign in');
+  e.code = 'not_authenticated';
+  return e;
+}
+
+async function apiFetch(path, options = {}, _retried = false) {
   const { token, serverUrl } = await getConfig();
 
   if (!token) {
-    throw new Error(
-      'Havril token not set — open the extension popup to configure it',
-    );
+    if (_retried) throw notAuthError();
+    await rotateAccessToken();
+    return apiFetch(path, options, true);
   }
 
   const response = await fetch(`${serverUrl}${path}`, {
@@ -33,9 +53,13 @@ async function apiFetch(path, options = {}) {
 
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
-    if (body.code === 'expired_token') {
+    if (body.code === 'expired_token' && !_retried) {
       await rotateAccessToken();
-      return apiFetch(path, options);
+      return apiFetch(path, options, true);
+    }
+    if (response.status === 401) {
+      await clearSession();
+      throw authError();
     }
     throw new Error(body.error || `HTTP ${response.status}`);
   }
@@ -55,24 +79,38 @@ async function submitConversation(conversation, sourceModel) {
   });
 }
 
+let inflightRefresh = null;
+
 async function rotateAccessToken() {
-  const { refreshToken, serverUrl } = await getConfig();
-  if (!refreshToken) {
-    throw new Error('Not logged in please open the extension to log in');
-  }
+  if (inflightRefresh) return inflightRefresh;
+
+  inflightRefresh = (async () => {
+    try {
+      const { refreshToken, serverUrl } = await getConfig();
+      if (!refreshToken) {
+        await clearSession();
+        throw notAuthError();
+      }
 
-  const response = await fetch(`${serverUrl}${`/v1/auth/refresh`}`, {
-    method: 'POST',
-    body: JSON.stringify({ refresh_token: refreshToken }),
-  });
+      const response = await fetch(`${serverUrl}/v1/auth/refresh`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+      });
 
-  if (!response.ok) {
-    const body = await response.json().catch(() => ({}));
-    throw new Error(body.error || `HTTP ${response.status}`);
-  }
+      if (!response.ok) {
+        await clearSession();
+        throw authError();
+      }
 
-  const { token } = await response.json();
-  await chrome.storage.session.set({ token });
+      const { token } = await response.json();
+      await chrome.storage.session.set({ token });
+    } finally {
+      inflightRefresh = null;
+    }
+  })();
+
+  return inflightRefresh;
 }
 
 // ── OAuth tab handling ────────────────────────────────────────────────────────
@@ -93,8 +131,13 @@ chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {
   const userAvatar = url.searchParams.get('avatar') || '';
   if (!token) return;
 
-  await chrome.storage.session.set({ token, refreshToken });
-  await chrome.storage.sync.set({ userName, userEmail, userAvatar });
+  await chrome.storage.session.set({ token });
+  await chrome.storage.local.set({ refreshToken });
+  await chrome.storage.sync.set({
+    userName,
+    userEmail,
+    userAvatar,
+  });
 
   await chrome.storage.session.remove(['authTabId']);
   chrome.tabs.remove(tabId);
@@ -126,8 +169,8 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
       case 'LIST_MEMORIES': {
         return apiFetch('/v1/memory');
       }
-      case 'GET_CONFIG': {
-        return getConfig();
+      case 'GENERATE_MCP_TOKEN': {
+        return apiFetch('/v1/mcp/token', { method: 'POST' });
       }
       case 'START_OAUTH': {
         const { provider } = message.payload;
@@ -138,12 +181,7 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
         return { started: true };
       }
       case 'LOGOUT': {
-        await chrome.storage.session.remove(['token', 'refreshToken']);
-        await chrome.storage.sync.remove([
-          'userName',
-          'userEmail',
-          'userAvatar',
-        ]);
+        await clearSession();
         return { ok: true };
       }
       default:
@@ -153,7 +191,9 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
 
   handle()
     .then((data) => sendResponse({ ok: true, data }))
-    .catch((err) => sendResponse({ ok: false, error: err.message }));
+    .catch((err) =>
+      sendResponse({ ok: false, error: err.message, code: err.code }),
+    );
 
   return true;
 });