mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-03 22:02:08 +03:00
ab01d74306
POST /api/oauth/codex/import accepted a payload with an already-invalidated refresh_token and persisted it as an 'active' connection that could never work — the failure surfaced confusingly only on first real use, long after the import looked successful. Validate each record's refresh_token against OpenAI's OAuth endpoint before persisting, reusing refreshCodexToken() (free exchange, no quota). On an unrecoverable refresh error the record is rejected with a clear re-auth message; a valid token imports as before, with any rotated tokens applied. Bulk import still processes each record independently — one dead token no longer blocks the valid ones. Reproduced live 2026-07-16: a 2026-07-10 auth.json imported clean but its refresh_token returned 401 refresh_token_invalidated. TDD: 3 tests RED against the old route, 5/5 GREEN with the fix. Closes #7522