nvrl 43e513924c fix(http): a token refresh survives its caller, and is never repeated ...

Proton refresh tokens are single-use. refresh_access_token ran inside
the caller's future, so a timeout around the request could drop it after
Proton rotated the tokens but before the client stored them, and the
session was gone. It now runs on its own task: the tokens are stored and
the callback fired whether or not anyone still waits.

auth/v4/refresh went through send_retrying, which repeats on timeouts,
408, 429 and 5xx. Any of those may come after the server rotated, and the
retry then spends the old token again and gets InvalidRefreshToken. The
refresh is now retried only when the connection failed.

2026-10-09 11:45:36 +02:00

..

proton-drive-rs

feat(account): hold key passphrases as wiped secrets and report a locked account as KeysLocked

2026-10-07 02:24:51 +02:00

proton-sdk

fix(http): a token refresh survives its caller, and is never repeated

2026-10-09 11:45:36 +02:00