Skip to content

feat(auth): say when a dcd login session has expired - #303

Merged
finalerock44 merged 1 commit into
devfrom
feat/2014-session-limits
Nov 9, 2026
Merged

finalerock44 merged 1 commit into
devfrom
feat/2014-session-limits

Conversation

@finalerock44

Copy link
Copy Markdown
Contributor

When Supabase Auth refuses to refresh a dcd login session, the CLI used to echo its message ("Failed to refresh session: Invalid Refresh Token: Session Expired. Run dcd login again."). It now names the two common causes, keyed on the error code Supabase sends:

  • session_expired (the session passed the project's maximum length or inactivity timeout): "Your session expired. Run dcd login to sign in again."
  • session_not_found / refresh_token_not_found (the session was ended): "Your session was signed out. Run dcd login to sign in again."

Other refusals keep Supabase's message. The code is kept on SessionRefreshError. supabase-js reports session_not_found as an AuthSessionMissingError rather than an AuthApiError, so that case was treated as a transient failure and retried; it is now final like any other refusal.

A poll that loses its session no longer repeats itself ("session expired and could not be refreshed: Your session expired"): it shows the refresh error, then the reconnect command. dcd-mcp gets the new text through runTool.

What & why

Type of change

  • fix — bug fix
  • feat — new feature
  • perf — performance improvement
  • refactor — code change that's neither a fix nor a feature
  • docs — documentation only
  • chore / ci / build / test — tooling, no user-facing change
  • Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

  • PR title follows the Conventional Commits format (see comment above)
  • pnpm lint passes
  • pnpm typecheck passes
  • pnpm build passes
  • I have not bumped the version or edited CHANGELOG.md (release-please handles this)
  • I have signed the CLA (the bot will prompt on first contribution)
  • Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test

When Supabase Auth refuses to refresh a `dcd login` session, the CLI used
to echo its message ("Failed to refresh session: Invalid Refresh Token:
Session Expired. Run `dcd login` again."). It now names the two common
causes, keyed on the error code Supabase sends:

- `session_expired` (the session passed the project's maximum length or
  inactivity timeout): "Your session expired. Run `dcd login` to sign in
  again."
- `session_not_found` / `refresh_token_not_found` (the session was ended):
  "Your session was signed out. Run `dcd login` to sign in again."

Other refusals keep Supabase's message. The code is kept on
SessionRefreshError. supabase-js reports `session_not_found` as an
AuthSessionMissingError rather than an AuthApiError, so that case was
treated as a transient failure and retried; it is now final like any other
refusal.

A poll that loses its session no longer repeats itself ("session expired
and could not be refreshed: Your session expired"): it shows the refresh
error, then the reconnect command. dcd-mcp gets the new text through
runTool.
@finalerock44 finalerock44 self-assigned this Nov 9, 2026
@claude

claude Bot commented Nov 9, 2026

Copy link
Copy Markdown

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

@finalerock44
finalerock44 merged commit 9fafa2f into dev Nov 9, 2026
9 checks passed
@finalerock44
finalerock44 deleted the feat/2014-session-limits branch November 9, 2026 15:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant