From 13098989e8b0d2f93d2047d56150f251deed4155 Mon Sep 17 00:00:00 2001 From: backryun Date: Fri, 14 Aug 2026 12:57:58 +0900 Subject: [PATCH] fix(types): narrow refresh token rotation inputs (#10257) --- open-sse/services/refreshSerializer.ts | 4 ++-- tests/unit/refresh-serializer.test.ts | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/open-sse/services/refreshSerializer.ts b/open-sse/services/refreshSerializer.ts index f71d5c4190..55f37c62ce 100644 --- a/open-sse/services/refreshSerializer.ts +++ b/open-sse/services/refreshSerializer.ts @@ -112,8 +112,8 @@ export async function serializeRefresh(provider: string, fn: () => Promise * and codex-lb's replica race-detection. */ export function wasRefreshTokenRotated( - attemptedRefreshToken: string | null | undefined, - latestRefreshToken: string | null | undefined + attemptedRefreshToken: unknown, + latestRefreshToken: unknown ): boolean { return ( typeof attemptedRefreshToken === "string" && diff --git a/tests/unit/refresh-serializer.test.ts b/tests/unit/refresh-serializer.test.ts index f764bd0d90..5b80ce4b3e 100644 --- a/tests/unit/refresh-serializer.test.ts +++ b/tests/unit/refresh-serializer.test.ts @@ -109,4 +109,6 @@ test("wasRefreshTokenRotated: true only when the DB token changed to a non-empty assert.equal(wasRefreshTokenRotated("rt-old", ""), false, "empty DB token = deactivate"); assert.equal(wasRefreshTokenRotated(null, "rt-new"), false, "unknown attempted = deactivate"); assert.equal(wasRefreshTokenRotated(undefined, undefined), false); + assert.equal(wasRefreshTokenRotated("rt-old", { token: "rt-new" }), false); + assert.equal(wasRefreshTokenRotated(42, "rt-new"), false); });