tokens

Token lifecycle after login, as Effects: refresh a VerifiedSession and best-effort revocation. Code exchange is not here: it only happens inside flow.callback, after state and iss have been checked.

Both calls re-fetch and re-verify the authorization server metadata from the session’s issuer rather than trusting a stored endpoint.

Values

refresh

pub fn refresh(
  current: session.VerifiedSession,
  client_auth: transport.ClientAuth,
) -> effect.Effect(
  Result(session.VerifiedSession, session.TokenError),
)

Exchange the session’s refresh token for new tokens. The response must pass the same checks as the original code exchange and carry the same sub. When the server does not rotate the refresh token, the current one is kept.

revoke

pub fn revoke(
  current: session.VerifiedSession,
  client_auth: transport.ClientAuth,
) -> effect.Effect(Nil)

Best-effort revocation at logout: the refresh token when there is one, else the access token, at the verified issuer’s revocation endpoint. Failures are ignored (the caller clears its local session regardless).