toeverything/AFFiNE · error · AuthSessionError

AUTH_TOKEN_RESPONSE_INVALID

AUTH_TOKEN_RESPONSE_INVALID

Error message

AUTH_TOKEN_RESPONSE_INVALID

What it means

toPair validates the refresh response and throws AUTH_TOKEN_RESPONSE_INVALID when expiresIn is not a positive finite number, so a malformed token response from the server never becomes a stored session.

Source

Thrown at packages/common/auth/src/token-broker.ts:338

        return await this.transport.refresh(refreshToken);
      } catch (error) {
        const classified = classifyAuthError(error);
        const delay = this.retryDelays[attempt];
        if (!classified.transient || delay === undefined) throw classified;
        await this.sleep(delay * (0.75 + this.random() * 0.5));
      }
    }
  }

  private toPair(response: AuthTokenResponse): AuthTokenPair {
    const accessExpiresAt = this.now() + response.expiresIn * 1000;
    if (
      !Number.isFinite(response.expiresIn) ||
      response.expiresIn <= 0 ||
      !Number.isFinite(accessExpiresAt) ||
      Math.abs(accessExpiresAt) > 8.64e15
    ) {
      throw new AuthSessionError('AUTH_TOKEN_RESPONSE_INVALID', true);
    }
    const pair: AuthTokenPair = {
      version: 1,
      tokenType: response.tokenType,
      accessToken: response.accessToken,
      accessExpiresAt: new Date(accessExpiresAt).toISOString(),
      refreshToken: response.refreshToken,
      refreshExpiresAt: response.refreshExpiresAt,
      session: response.session,
    };
    if (!isAuthTokenPair(pair)) {
      throw new AuthSessionError('AUTH_TOKEN_RESPONSE_INVALID', true);
    }
    return pair;
  }

  private toSnapshot(pair: AuthTokenPair): AuthSessionSnapshot {
    return {

View on GitHub (pinned to b4c8548c09)

Solutions

1. Retry the authentication flow; the token endpoint returned a malformed response.
2. Check the auth server or proxy for modifications to the token response.
3. Verify the client_id and token endpoint configuration match the auth server.

When it happens

Trigger: Thrown at packages/common/auth/src/token-broker.ts:338 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/3929112fd0b7a0ef. Report an issue: GitHub.