fix(mobile): only log out on a genuinely rejected refresh token (port #2812)

[Gilbert09]

Summary

Ports desktop #2812 ("fix(auth): Log out on rejected refresh token instead of stalling startup") to the React Native / Expo app at apps/mobile.

Mobile has its own OAuth refresh path (not the core OAuthService). refreshAccessToken threw a generic Error on any non-ok response, and initializeAuth deleted the stored tokens and signed the user out on any thrown error. A transient network or server blip at startup therefore logged the user out unnecessarily — the exact bug #2812 guards against.

Changes

• lib/oauth.ts — refreshAccessToken now classifies the failure and throws a TokenRefreshError carrying an errorCode, mirroring desktop's categories:

  • 401/403, or 400 with invalid_grant/invalid_token → auth_error (token genuinely dead)
  • 5xx → server_error (transient, retryable)
  • thrown fetch (DNS/TLS/socket) → network_error
  • other 400s (e.g. invalid_client/invalid_request, config bugs) → unknown_error

  A small helper parses the OAuth error code from the JSON body and tolerates non-JSON bodies.

• stores/authStore.ts — initializeAuth now only deletes tokens / signs out on auth_error. On transient or config failures it keeps the stored session, so the next request's existing per-request authedFetch retry path (mobile fix(mobile): auto-refresh on PostHog 401/403 auth failures #2408) can recover. Also deduped the repeated auth-clearing set({...}) payload into a shared CLEARED_AUTH_STATE.

The proactive scheduleTokenRefresh handler is intentionally left as-is: it already keeps the session on every error (it only logs), so it never had the bug, and logging out from a background timer on a still-valid access token would be a new behavior beyond this port.

Tests

• lib/oauth.test.ts (new) — covers the classification: 401/403 → auth_error, 400 invalid_grant/invalid_token → auth_error, 400 invalid_client/invalid_request → unknown_error, 5xx → server_error, thrown fetch → network_error.
• stores/authStore.test.ts — initializeAuth with an expired token: auth_error → tokens deleted + signed out; server_error/network_error/unknown_error → session kept, no token deletion.

pnpm --filter @posthog/mobile lint and the auth/api test suites pass.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 074fb2f.}

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
apps/mobile/src/features/auth/stores/authStore.ts:370-372
The spread `{ ...CLEARED_AUTH_STATE }` in `logout` creates an identical shallow copy with no additions. `set` accepts a partial state directly, so the spread is superfluous here. The other two call sites correctly add `isLoading: false` to the spread, which is why the spread is needed there — but not here.

```suggestion
        set(CLEARED_AUTH_STATE);
      },
    }),
```

_{Reviews (1): Last reviewed commit: "fix(mobile): only log out on a genuinely..." | Re-trigger Greptile}