DigitalTolk / ex / 25278759450

92%

push

github

fix(auth): support X-Refresh-Token header; pass refresh token to desktop callback (#57)

Two changes to make Tauri desktop sessions survive reloads:

1. RefreshToken endpoint now accepts the refresh token via the
   X-Refresh-Token request header in addition to the httpOnly cookie.
   Desktop apps store the token in the OS keychain (not a browser
   cookie) and send it this way.

2. OIDCCallback appends &refresh=<token> to the redirect URL when the
   target is a localhost HTTP URL (the Tauri one-shot callback server).
   The token is only exposed to the local process — it never appears in
   a browser URL bar and is stored in the OS keychain immediately.

3171 of 3796 branches covered (83.54%)

Branch coverage included in aggregate %.

14 of 16 new or added lines in 1 file covered. (87.5%)

12439 of 13564 relevant lines covered (91.71%)

1308.83 hits per line