{"record":{"id":"f1b34254e6248b64","repo":"eyaltoledano/claude-task-master","slug":"no-refresh-token-received-from-server-session-re","errorCode":null,"errorMessage":"No refresh token received from server - session refresh will not work","messagePattern":"No refresh token received from server - session refresh will not work","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/tm-core/src/modules/auth/services/oauth-service.ts","lineNumber":207,"sourceCode":"\t\t}\n\n\t\t// Notify that we're waiting for authentication\n\t\tif (onWaitingForAuth) {\n\t\t\tonWaitingForAuth();\n\t\t}\n\n\t\t// Step 4: Poll for completion\n\t\tconst credentials = await this.pollForCompletion(\n\t\t\tflow_id,\n\t\t\tpoll_interval * 1000,\n\t\t\ttimeout\n\t\t);\n\n\t\t// Set the session in Supabase client\n\t\t// Note: Only set session if we have a valid refresh token\n\t\t// Supabase requires a valid refresh_token to manage token lifecycle\n\t\tif (!credentials.refreshToken) {\n\t\t\tthis.logger.warn(\n\t\t\t\t'No refresh token received from server - session refresh will not work'\n\t\t\t);\n\t\t}\n\n\t\tconst session: Session = {\n\t\t\taccess_token: credentials.token,\n\t\t\trefresh_token: credentials.refreshToken ?? '',\n\t\t\texpires_in: credentials.expiresAt\n\t\t\t\t? Math.floor(\n\t\t\t\t\t\t(new Date(credentials.expiresAt).getTime() - Date.now()) / 1000\n\t\t\t\t\t)\n\t\t\t\t: 3600,\n\t\t\ttoken_type: 'bearer',\n\t\t\tuser: {\n\t\t\t\tid: credentials.userId,\n\t\t\t\temail: credentials.email,\n\t\t\t\tapp_metadata: {},\n\t\t\t\tuser_metadata: {},","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/tm-core/src/modules/auth/services/oauth-service.ts#L189-L225","documentation":"During PKCE authentication the backend returned credentials without a refresh_token. The OAuth service still builds a session with the access token but warns that Supabase cannot manage token lifecycle without a refresh token, so session persistence and silent refresh will not work — the user will have to log in again when the access token expires.","triggerScenarios":"Completing the OAuth PKCE flow (authenticateWithBackendPKCE) against a backend/Supabase project whose configuration omits refresh tokens — e.g. Supabase auth with a client that doesn't return refresh_token, a custom backend proxy that strips it, or non-refreshable grant types.","commonSituations":"Supabase project configured with short-lived JWTs and refresh tokens disabled; custom auth backend forwarding only access_token; third-party OAuth provider misconfiguration; API version drift where the token exchange response schema changed.","solutions":["Check the backend/Supabase auth settings so the token exchange returns refresh_token and forward it in credentials.","Update the OAuth client configuration (e.g. ensure offline access / refresh tokens are enabled for the provider).","Verify the client parses credentials.refreshToken from the correct response field after API changes.","Accept short sessions and force re-login on each token expiry if refresh tokens are intentionally unsupported."],"exampleFix":"// before\nreturn { token: data.access_token }; // refresh_token dropped\n// after\nreturn { token: data.access_token, refreshToken: data.refresh_token };","handlingStrategy":"validation","validationCode":"if (!credentials.refreshToken) {\n  console.warn('Session will not be refreshable; re-login will be required on token expiry.');\n  // or abort: throw new Error('Backend did not return a refresh token');\n}","typeGuard":"function isRefreshableCredentials(c) {\n  return typeof c.token === 'string' && c.token.length > 0 &&\n         typeof c.refreshToken === 'string' && c.refreshToken.length > 0;\n}","tryCatchPattern":"try {\n  await authService.authenticate();\n} catch (err) {\n  if (err instanceof AuthenticationError && /refresh token/i.test(err.message)) {\n    promptReLogin(); // full login required since silent refresh is unavailable\n  }\n}","preventionTips":["Ensure Supabase/backend auth config issues refresh tokens (offline access enabled, refresh token rotation configured).","Verify custom backend proxies forward the full token exchange response.","Update clients when the token endpoint response schema changes.","Test a full login→expiry→refresh cycle in CI to catch missing refresh tokens early."],"tags":["auth","oauth","pkce","supabase","session","refresh-token"],"backgroundTag":"missing-refresh-token","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}