{"record":{"id":"2ffdc00691822397","repo":"different-ai/openwork","slug":"continuity-refresh","errorCode":"CONTINUITY_REFRESH","errorMessage":"Refresh unexpectedly succeeded after the mock credential expired","messagePattern":"Refresh unexpectedly succeeded after the mock credential expired","errorType":"exception","errorClass":"ProbeFailure","httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-mock-server/src/testing/probe.ts","lineNumber":710,"sourceCode":"    sensitiveValues.push(accessToken, refreshToken)\n    recordPassed(phases, \"AUTH_TOKEN_ACQUISITION\", startedAt, \"Authorization code and PKCE token exchange passed\")\n\n    if (activeFault?.effect === \"refresh-expired\") {\n      startedAt = Date.now()\n      const refreshForm = new URLSearchParams({\n        grant_type: \"refresh_token\",\n        client_id: clientId,\n        refresh_token: refreshToken,\n      })\n      if (tokenAuthMethod === \"client_secret_post\") refreshForm.set(\"client_secret\", clientSecret)\n      const refreshResponse = await fetchStep(tokenEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: refreshForm,\n      }, \"CONTINUITY_REFRESH\", overallDeadline)\n      if (refreshResponse.ok) {\n        await discardResponseBody(refreshResponse, \"CONTINUITY_REFRESH\", \"oauth_credential_expired\")\n        throw new ProbeFailure(\"CONTINUITY_REFRESH\", \"oauth_refresh_unexpected_success\", \"Refresh unexpectedly succeeded after the mock credential expired\")\n      }\n      const message = await safeHttpErrorMessage(refreshResponse, \"CONTINUITY_REFRESH\", \"oauth_credential_expired\")\n      throw new ProbeFailure(\"CONTINUITY_REFRESH\", \"oauth_credential_expired\", `${message} Reauthorization is required.`)\n    }\n\n    const rpcHeaders = {\n      authorization: `Bearer ${accessToken}`,\n      accept: \"application/json, text/event-stream\",\n      \"content-type\": \"application/json\",\n      origin: baseUrl.origin,\n    }\n    startedAt = Date.now()\n    const initializeRawResponse = await fetchStep(mcpUrl, {\n        method: \"POST\",\n        headers: rpcHeaders,\n        body: JSON.stringify({\n          jsonrpc: \"2.0\",\n          id: 1,","sourceCodeStart":692,"sourceCodeEnd":728,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-mock-server/src/testing/probe.ts#L692-L728","documentation":"The continuity phase intentionally exercises an expired mock credential: the probe refreshes a token whose refresh token the mock has marked expired, expecting the token endpoint to reject it. If the refresh unexpectedly returns a 2xx, the probe throws CONTINUITY_REFRESH / oauth_refresh_unexpected_success because the mock's expiry enforcement is broken — the probe would never observe the intended expired-credential path.","triggerScenarios":"Running probeEnterpriseMcpMockServer in a continuity scenario where the mock credential should be expired, but the POST to the token endpoint with grant_type=refresh_token returns ok (status 2xx) at probe.ts:708-711.","commonSituations":"Mock server clock/expiry bookkeeping not applied (expiry timestamps not enforced, or tokens never marked expired); scenario misconfiguration where the expiry-trigger step didn't run; caching layer serving stale non-expired tokens.","solutions":["Fix the mock authorization server so expired refresh tokens are actually rejected (enforce the expiry timestamp before granting).","Verify the preceding step that expires the mock credential actually executed (check scenario ordering/flags).","Clear any token cache between expiry and refresh so the token endpoint sees the expired token."],"exampleFix":"// before (mock token endpoint)\nif (refreshTokenRecord) return issueTokens(refreshTokenRecord) // expiry ignored\n// after\nif (refreshTokenRecord && refreshTokenRecord.expiresAt > Date.now()) return issueTokens(refreshTokenRecord)\nreturn res.status(400).json({ error: \"invalid_grant\" })","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await probeEnterpriseMcpMockServer(scenario)\n} catch (e) {\n  if (e instanceof ProbeFailure && e.message.includes('Refresh unexpectedly succeeded')) {\n    // the mock's expiry enforcement is broken: fail the environment check loudly\n    console.error('Mock AS did not reject expired refresh token — fix expiry enforcement', e)\n    process.exitCode = 1\n  } else throw e\n}","preventionTips":["Unit-test that the mock token endpoint rejects expired refresh tokens.","Ensure the scenario step that expires the credential runs before the refresh.","Avoid caching issued tokens in a way that bypasses expiry checks."],"tags":["oauth","token-refresh","mock-server","continuity"],"backgroundTag":"token-refresh-not-revoked","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}