[diegosouzapw]

Problem

Even after the quota-sync (refreshAndUpdateCredentials) and connection-test guards (#2941), opening the Quota / Providers dashboard still cascaded Codex multi-account setups — all accounts of the same domain died with [403] <!DOCTYPE.

Root cause (traced live on the VM via call_logs + proxy_logs + authenticated reproduction)

The deployed quota-page paths are clean:

• GET /api/usage/[id] (quota data) → skips rotating providers ✅ (verified, HTTP 200 no refresh)
• POST /api/providers/[id]/test (status) → skips rotating providers ✅ (fix(auth): prevent Codex multi-account refresh_token family revocation (openai/codex#9648) #2941 guard, verified)

But POST /api/providers/[id]/refresh (the manual/auto "refresh token" endpoint) had no rotating-provider guard — verified empirically: calling it on a Codex connection triggered refresh_token_reused. The dashboard auto-refreshes every expiring connection on a page load (and an old cached frontend still bulk-calls it), so each Codex account's single-use refresh_token got rotated. Under the shared Auth0 client_id, Auth0 revoked the whole token family (openai/codex#9648) → every account but the last died.

This was the last unguarded proactive-refresh entry point for rotating providers.

Fix

POST /api/providers/[id]/refresh now skips proactive rotation when rotationGroupFor(provider) !== null, returning { success: true, skipped: true, message } and deferring genuine expiry to the reactive, serialized 401 path on the next real request. Non-rotating providers keep refreshing on demand. Same guard pattern as refreshAndUpdateCredentials and the connection-test route.

Test (TDD, red→green)

tests/unit/codex-manual-refresh-rotating-guard.test.ts — source-assertion style (matches token-refresh-race-comprehensive.test.ts #2941): asserts the route imports rotationGroupFor and guards before getAccessToken, returning early.

Regression: token-refresh-race-comprehensive, refresh-serializer, codex-quota-sync-no-proactive-refresh, providers-test-route-cli-map all pass. lint + typecheck clean.

Operator note

Existing dashboard tabs should be hard-refreshed (Ctrl+Shift+R) to drop the old cached frontend; this backend guard makes the cascade impossible regardless.

[gemini-code-assist]

Code Review

This pull request introduces a guard in the manual/auto token refresh endpoint (POST /api/providers/[id]/refresh) to skip proactive token rotation for rotating-refresh providers (such as Codex/OpenAI sharing an Auth0 client ID). This prevents Auth0 token-family revocation when multiple sibling accounts are refreshed concurrently or in bulk. A unit test has been added to verify that the route imports rotationGroupFor and applies the guard before calling getAccessToken, and the CHANGELOG.md has been updated. I have no feedback to provide.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This PR addresses a critical issue with Codex multi-account family-revocation cascade by adding a guard in the manual refresh endpoint to skip proactive token rotation for rotating-refresh providers (Codex/OpenAI share an Auth0 client_id).

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Files Reviewed (3 files)

• src/app/api/providers/[id]/refresh/route.ts - Guard logic for rotating providers, uses sanitized error response
• tests/unit/codex-manual-refresh-rotating-guard.test.ts - Source-assertion tests verifying guard placement
• CHANGELOG.md - Documentation of fix

Observations

Security: The error handling at line 142 uses (error as Error).message which is already covered by internal logging patterns. This is acceptable since:

• The endpoint already exists and follows existing patterns in the codebase
• Error messages here are operational (not exposing upstream provider errors that would need upstream sanitization)

Consistency: The import path @omniroute/open-sse/services/refreshSerializer.ts uses .ts extension which is the established pattern in this codebase (111 existing imports across src/app/api/ and test files).

Guard Logic Verification: The guard at line 61 correctly:

• Checks rotationGroupFor(provider) !== null before any token refresh attempt
• Returns early with skipped: true flag for rotating providers
• Defers to the reactive, serialized 401 path for genuine expiry handling
• Matches the existing pattern in test/route.ts (line 430) for the same protection

---

_{Reviewed by laguna-m.1-20260312:free · 2,185,764 tokens}