Sharang Parnerkar
bec47f8c7d
CI / Check (pull_request) Successful in 8m7s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
The dashboard stored a refresh_token in the session at login (auth.rs)
but never used it. Once the access_token's 5-minute lifespan ran out,
every subsequent agent call failed with 401 ExpiredSignature. The UI
showed "unable to load X" until the user logged out and back in.
Fix: before attaching the bearer, decode the JWT's `exp` claim and
proactively refresh via the stored refresh_token if the token is
expired or within REFRESH_SKEW_SECS (30s) of expiry. Updates the
session with the new access_token (and rotated refresh_token if KC
sends one). Refresh failures fall through with the stale token so the
agent's 401 surfaces to the UI rather than failing the request at the
dashboard layer.
Why "proactive" instead of "retry on 401"
- Saves a wasted round-trip on every agent call once the token has
aged past 5 min.
- Doesn't require cloning RequestBuilder bodies for retry.
- Same end state — fresh token reaches the agent.
Test plan
- cargo test -p compliance-dashboard --features server
--no-default-features infrastructure::agent_client::tests — 5 pass:
* expired JWT → refresh
* near-expiry within skew window → refresh
* fresh JWT → no refresh
* malformed/empty JWT → refresh (defensive)
* JWT without exp claim → refresh (defensive)
- Manual after deploy: dashboard works past the 5-min token lifespan
without manual re-login.
Note
- The refresh code addresses the ExpiredSignature failure mode. The
separate "JWT is missing tenant_id claim" 401 is a Keycloak realm
config issue (the user logging in lacks the M7.1 attributes that
the protocol mappers consume) and is fixed by realm/attribute
config, not by this PR.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>