PR Custody

fix(auth): recover expired WorkOS sessions in tRPC context instead of 401ing

@shamsharoonchecks n/achecks…fix/trpc-unauthorized-token-refresh → main5 files · +282 −105updated 3d ago

▸Description · 1 noise

What's wrong

Production is emitting bursts of bare tRPC UNAUTHORIZED errors during page-load fan-out. WorkOS access tokens expire after ~5 minutes; when parallel requests race the middleware refresh-token rotation, the losers reach createTRPCContext with no access token and no session because withAuth() / getSession() read the stale middleware-sealed header. Those requests 401 until a reload or re-auth path recovers.

Datadog confirms this in production (service:composio-dashboard "tRPC error [UNAUTHORIZED]"), but the similar preview/staging/local symptoms are not proven to be the same root cause. Preview mostly shows separate issuer/JWT/permission errors.

Impact

Datadog, service:composio-dashboard "tRPC error [UNAUTHORIZED]" (bare — upstream permission messages excluded), last 7 days: ~10.2k errors, avg ~1.5k/day, peak 5.1k on Jun 8. tRPC error logging only got full coverage on Jun 8 (#762), so earlier days undercount.

day	count
Jun 3	669
Jun 4	1,201
Jun 5	810
Jun 6	530
Jun 7	538
Jun 8	5,143
Jun 9	1,218

Top procedures (48h sample): logs.pollActionLogs 4,424 (idle-tab polling — self-heals but floods logs), org.getOrgPlans 361, org.listOrgs 340, toolkits.getToolkit 180, toolkits.listToolkits 92 — the non-polling ones surface as user-visible 401 error states on page load.

Fix

In tRPC route-handler contexts, retry refreshSession() once when withAuth() has no access token, then rebuild the dashboard session from the refreshed WorkOS user.
Skip this refresh in RSC contexts, where refreshSession() can rotate the token before a cookie write that cannot complete.
Mark true no-session tRPC auth failures with SESSION_EXPIRED so the client redirects through /sign-in only for recoverable dead-session errors, not permission/scoping UNAUTHORIZEDs.
Convert refresh-path org/project misses into controlled FORBIDDEN responses.

Verification

Datadog production: target bare UNAUTHORIZED pattern is active; preview/staging/local are not confirmed as the same bug.
pnpm exec vitest run src/clients/trpc/errors.test.ts
pnpm exec oxlint --config .oxlintrc.json src/clients/auth/server.ts src/clients/query-client.ts src/clients/trpc/errors.ts src/clients/trpc/errors.test.ts src/server/api/trpc.ts
SKIP_ENV_VALIDATION=1 pnpm typecheck

▸ 1 bot/status comment hidden

@vercel[bot]3d ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	Jun 10, 2026 2:14am

loading diff…