Handle expired signature GraphQL errors with ApolloAuthInterceptor

[AndrewCheung360]

Overview

Fixed the issue where GraphQL queries would fail with a "Signature has expired" error, even when returning a 200 OK HTTP status code.

Changes Made

• Created ApolloAuthInterceptor to detect GraphQL-level "Signature has expired" errors in the response body.
• Implemented automatic token refresh and request retry logic within the interceptor to seamlessly recover from expired sessions.
• Added RetryContext to prevent infinite retry loops in case of persistent authentication failures.
• Registered the new interceptor in AppModule for the primary ApolloClient.

Test Coverage

• Verified that ProfileRepository.getProfile() properly handles the expired signature error by triggering a refresh and successfully completing the query on retry.
• Manual testing of the session refresh flow by simulating an expired token.

Related PRs or Issues

Fixes the "Failed to load profile" crash caused by expired tokens.

Summary by CodeRabbit

• New Features
  • Added automatic token refresh handling that transparently refreshes expired access tokens, retries the original request once, and avoids redundant refreshes across concurrent requests.
  • Integrated the refresh mechanism into the app's network client so auth is automatically applied to outgoing requests.
  • If refresh fails or no refresh token exists, the session is terminated (logout) to ensure a consistent state.

Update

• Fixed a bug where the header was missing from inside the interceptor, preventing proper token comparison.
• Updated the interceptor to be flow-aware, ensuring only the final response (after retry) is emitted to the collector.

Update

• Fixed a bug where the Authorization header was missing from ApolloRequest inside the interceptor, preventing proper token comparison.
• Updated the interceptor to be flow-aware, ensuring only the final response (after retry) is emitted to the collector.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds an ApolloAuthInterceptor that injects access tokens, detects "Signature has expired" GraphQL errors, attempts a one-time refresh via a dedicated refresh Apollo client (serialized with a mutex), updates tokens, retries the original request, and triggers logout on refresh failure. Integrates the interceptor into the main Apollo client provider.

Changes

Cohort / File(s)	Summary
Apollo Auth Interceptor app/src/main/java/com/cornellappdev/uplift/data/auth/ApolloAuthInterceptor.kt	New @SingletonApolloAuthInterceptor and RetryContext added. Reads access token from TokenManager, injects Authorization header, detects "Signature has expired" GraphQL errors, performs serialized refresh via RefreshAccessTokenMutation using @Named("refresh") Apollo client, saves tokens, retries once, or calls sessionManager.logout() on failure.
Dependency Injection app/src/main/java/com/cornellappdev/uplift/di/AppModule.kt	provideApolloClient provider signature updated to accept ApolloAuthInterceptor and adds it to the main Apollo client via .addInterceptor(...).

Sequence Diagram(s)

sequenceDiagram
participant Client
participant Interceptor as ApolloAuthInterceptor
participant TokenMgr as TokenManager
participant RefreshClient as ApolloClient (refresh)
participant SessionMgr as SessionManager
participant Server
Client->>Interceptor: Execute GraphQL request
Interceptor->>TokenMgr: Read access token
Interceptor->>Server: Send request (with access token)
Server-->>Interceptor: Response (error: "Signature has expired")
Interceptor->>Interceptor: Check RetryContext (not retried)
Interceptor->>TokenMgr: Get refresh token
TokenMgr-->>Interceptor: Refresh token (or null)
alt refresh token present
Interceptor->>RefreshClient: Execute RefreshAccessTokenMutation (Authorization: Bearer <refresh>)
RefreshClient->>Server: Refresh request
Server-->>RefreshClient: Return new access token (or none)
RefreshClient-->>Interceptor: New access token (or null)
alt new access token returned
Interceptor->>TokenMgr: Save new access token
Interceptor->>Interceptor: Increment RetryContext
Interceptor->>Server: Retry original request (with new access token)
Server-->>Interceptor: Success response
Interceptor-->>Client: Return successful response
else no token / refresh failed
Interceptor->>SessionMgr: Trigger logout()
Interceptor-->>Client: Return original/error response
end
else no refresh token
Interceptor->>SessionMgr: Trigger logout()
Interceptor-->>Client: Return original/error response
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Token and Session Management #106 — Implements related token-refresh/auth logic touching TokenManager, SessionManager, TokenAuthenticator, and AppModule DI that overlap with this interceptor-based refresh approach.

Poem

🐇 I sniffed an expired token in the night,
Slipped in a header, gave the refresh a bite.
With mutex and mutation, I hopped back on track,
New token in paw — request retried, no lack! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately captures the main change: introducing ApolloAuthInterceptor to handle expired signature GraphQL errors with automatic token refresh and retry logic.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description covers all major required sections: Overview, Changes Made, Test Coverage, and Related PRs/Issues. It documents the purpose, implementation details, testing approach, and issue resolution clearly.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/signature-expired-retry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@app/src/main/java/com/cornellappdev/uplift/data/auth/ApolloAuthInterceptor.kt`:
- Around line 66-67: In ApolloAuthInterceptor.kt inside ApolloAuthInterceptor
(likely in the intercept() catch block), don’t silently swallow the Exception
before calling sessionManager.logout(): capture the caught exception (e) and
record it via your app’s logging/telemetry mechanism (e.g., Timber.e /
logger.error / Sentry.captureException) with context about the token refresh
failure, then proceed to call sessionManager.logout(); ensure the log includes
the exception message/stacktrace and any relevant identifiers (userId/sessionId)
to aid diagnosis.
- Around line 47-70: The refresh branch in ApolloAuthInterceptor is racy:
multiple coroutines may run refreshClient.mutation(...) concurrently and one
failing path can call sessionManager.logout() even after another succeeded;
serialize refresh attempts by introducing a single synchronization point (e.g.,
a Mutex or synchronized block) around the refresh logic inside
ApolloAuthInterceptor: before calling refreshClient.mutation(...) acquire the
lock, re-check tokenManager.getRefreshToken() and/or current access token to see
if another coroutine already refreshed, perform the mutation/save via
tokenManager.saveTokens(newAccessToken, refreshToken) only while holding the
lock, then release it, and only call sessionManager.logout() if after the locked
check there is still no valid token; this mirrors the guard in
TokenAuthenticator and prevents concurrent refresh/logout races.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 49e1a5bb-302c-4e89-86e0-df87aab0971e

📥 Commits

Reviewing files that changed from the base of the PR and between 6ec2e24 and e0b9803.

📒 Files selected for processing (2)

• app/src/main/java/com/cornellappdev/uplift/data/auth/ApolloAuthInterceptor.kt
• app/src/main/java/com/cornellappdev/uplift/di/AppModule.kt

[AndrewCheung360]

Addressed comments by adding a Mutex to serialize token refresh attempts and improved error logging in ApolloAuthInterceptor. This prevents race conditions where multiple requests might trigger redundant refresh calls or unexpected logouts.