DigitalTolk / ex / 25278775230 / 2

90%

main: 92%

push

github

fix(auth): support X-Refresh-Token header; pass refresh token to desktop callback (#57)

Two changes to make Tauri desktop sessions survive reloads:

1. RefreshToken endpoint now accepts the refresh token via the
   X-Refresh-Token request header in addition to the httpOnly cookie.
   Desktop apps store the token in the OS keychain (not a browser
   cookie) and send it this way.

2. OIDCCallback appends &refresh=<token> to the redirect URL when the
   target is a localhost HTTP URL (the Tauri one-shot callback server).
   The token is only exposed to the local process — it never appears in
   a browser URL bar and is stored in the OS keychain immediately.

3171 of 3796 branches covered (83.54%)

Branch coverage included in aggregate %.

4211 of 4442 relevant lines covered (94.8%)

3978.69 hits per line