refreshSession

tcmts.atproto.refreshSession · #2lptmmed · term · runs on the server

uses tcmts.atproto.keepSession, which uses node:fs

Refresh a sign-in's tokens (and keep them): false when they can't be (expired, or revoked).

import { dpopFetch, keepSession } from "#codebase/tcmts/atproto";
import type { OAuthSession, TokenAnswer } from "#codebase/tcmts/atproto";

export async function refreshSession(s: OAuthSession): Promise<boolean> {
  if (!s.refreshToken) return false;
  const res = await dpopFetch(s.dpopKey, s.tokenEndpoint, {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: s.refreshToken,
      client_id: s.clientId,
    }).toString(),
  });
  if (!res.ok) return false;
  const t = (await res.json()) as TokenAnswer;
  if (t.sub !== s.did) return false;
  s.accessToken = t.access_token;
  if (t.refresh_token) s.refreshToken = t.refresh_token;
  s.expiresAt = Date.now() + (t.expires_in ?? 300) * 1000;
  if (t.scope) s.scope = t.scope;
  keepSession(s.did, s);
  return true;
}

uses

used by