auth: persist refresh token before access token on login

RecordLoginContext wrote the access token before the paired refresh
token, the same hazardous ordering fixed in contextTokenStore.SaveTokens.
If the refresh write failed, the keyring could hold a fresh access JWT
paired with a stale refresh token from an earlier login; on access-token
expiry that dead refresh token forces a re-login.

Write the refresh slot first (and the else-branch stale-token delete),
so a failed refresh write aborts before the access token is touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: toothbrush

cmd/entire/cli/auth/contexts.go

@@ -70,15 +70,17 @@ func RecordLoginContext(rawToken, refreshToken string, activate bool) (string, e
 		}
 	}
 
-	encoded := tokenstore.EncodeTokenWithExpiration(rawToken, expiresIn)
-	if err := tokenstore.Set(keychainService, handle, encoded); err != nil {
-		return "", fmt.Errorf("store login token in keyring: %w", err)
-	}
-
 	// The refresh token lives in the paired "<service>:refresh" slot (raw,
 	// no expiry suffix). Clear any prior one when this login carries none,
 	// so a stale token from an earlier session can't later be replayed
 	// against the server's single-use rotation and revoke the family.
+	//
+	// Write the refresh slot BEFORE the access token, matching
+	// contextTokenStore.SaveTokens: a partial write must never leave a fresh
+	// access token paired with a stale refresh token left over from an
+	// earlier login. Refresh-first means a failed refresh write aborts before
+	// the access token is touched (old pair preserved), rather than committing
+	// a new access JWT against a dead refresh token.
 	refreshSlot := tokenstore.RefreshService(keychainService)
 	if refreshToken != "" {
 		if err := tokenstore.Set(refreshSlot, handle, refreshToken); err != nil {
@@ -88,6 +90,11 @@ func RecordLoginContext(rawToken, refreshToken string, activate bool) (string, e
 		_ = tokenstore.Delete(refreshSlot, handle) //nolint:errcheck // best-effort cleanup of a stale refresh token
 	}
 
+	encoded := tokenstore.EncodeTokenWithExpiration(rawToken, expiresIn)
+	if err := tokenstore.Set(keychainService, handle, encoded); err != nil {
+		return "", fmt.Errorf("store login token in keyring: %w", err)
+	}
+
 	var name string
 	cfgDir := contexts.DefaultConfigDir()
 	if modErr := contexts.Modify(cfgDir, func(f *contexts.File) (bool, error) {

cmd/entire/cli/auth/contexts_test.go

@@ -25,6 +25,45 @@ func makeJWT(t *testing.T, payloadJSON string) string {
 	return header + "." + payload + "." + enc.EncodeToString([]byte("sig"))
 }
 
+// RecordLoginContext must persist the refresh token before the access token,
+// so a failed access write never commits a fresh access JWT against a stale
+// refresh token left over from an earlier login.
+func TestRecordLoginContext_RefreshFirstOrdering(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+
+	const coreURL = "https://core.example.com"
+	const handle = "alice"
+	svc := tokenstore.CoreKeyringService(coreURL)
+	path := filepath.Join(t.TempDir(), "tokens.json")
+
+	// A prior login left a stale refresh token in the slot.
+	seedRestore := tokenstore.UseFileBackendForTesting(path)
+	if err := tokenstore.Set(tokenstore.RefreshService(svc), handle, "entr_stale"); err != nil {
+		t.Fatalf("seed stale refresh: %v", err)
+	}
+	seedRestore()
+
+	// Fail the access-token write only.
+	failAccess := func(service, _ string) bool { return service == svc }
+	restore := tokenstore.UseFailingBackendForTesting(path, failAccess)
+	t.Cleanup(restore)
+
+	exp := time.Now().Add(2 * time.Hour).Unix()
+	token := makeJWT(t, fmt.Sprintf(`{"iss":%q,"handle":%q,"exp":%d}`, coreURL, handle, exp))
+	if _, err := RecordLoginContext(token, "entr_login_new", true); err == nil {
+		t.Fatal("RecordLoginContext: want error when access write fails")
+	}
+	// The refresh token must already be the new one (written first), and no
+	// access token may sit alongside the stale refresh token.
+	if r, _ := tokenstore.Get(tokenstore.RefreshService(svc), handle); r != "entr_login_new" { //nolint:errcheck // read-back
+		t.Fatalf("refresh slot = %q, want entr_login_new persisted before the access write", r)
+	}
+	if v, err := tokenstore.Get(svc, handle); !errors.Is(err, tokenstore.ErrNotFound) {
+		t.Fatalf("access slot = %q (err=%v); a fresh access token must not be committed when its write failed", v, err)
+	}
+}
+
 func TestRecordLoginContext_WritesContextAndToken(t *testing.T) {
 	// Sets ENTIRE_CONFIG_DIR and swaps the keyring backend — process-global
 	// state, so this test cannot run in parallel.