fix(secret-rotator): revoke old HA token over a new-token session

Conversation 0 Commits 1 Files Changed 1

+17 -7

1 Commits

Author	SHA1	Message	Date
claude-botandClaude Opus 4.8	2e18d68a94	fix(secret-rotator): revoke old HA token over a new-token session ci/woodpecker/push/build-ci-images Pipeline was successful Details Found by running the ha-token rotation end-to-end against live HA. The rotation was fully correct — new token minted, stored, and the old one revoked — but the job logged a false "OLD token REMAINS VALID" warning. Root cause: HA binds a WebSocket session to the refresh token behind its access token. The rotator authenticated with the OLD token and revoked that same token over that same session, so HA tore the session down as it processed the delete — the delete succeeded server-side but the ack could not be read, surfacing as "connection closed by HA". Verified: after the false-warning run, the old token's refresh id was already gone from HA. Fix: after storing the new token, drop the old session and reconnect with the NEW token to perform the revoke. The session is then not the one being deleted, so the ack reads cleanly and the report is accurate. This matters beyond cosmetics: the false warning fired on every successful rotation, which would train an operator to ignore it — and a genuine revoke failure would then be indistinguishable noise. With the fix, a warning means a real un-revoked token. Verified end-to-end against live HA on a throwaway token: revoke over the new session returns success=True and the old token is confirmed gone (where the old flow got "connection closed"). clippy -D warnings clean; 12 tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 12:14:55 +02:00

Author

SHA1

Message

Date

claude-botandClaude Opus 4.8

2e18d68a94

fix(secret-rotator): revoke old HA token over a new-token session

ci/woodpecker/push/build-ci-images Pipeline was successful

Details

Found by running the ha-token rotation end-to-end against live HA. The rotation
was fully correct — new token minted, stored, and the old one revoked — but the
job logged a false "OLD token REMAINS VALID" warning.

Root cause: HA binds a WebSocket session to the refresh token behind its access
token. The rotator authenticated with the OLD token and revoked that same token
over that same session, so HA tore the session down as it processed the delete
— the delete succeeded server-side but the ack could not be read, surfacing as
"connection closed by HA". Verified: after the false-warning run, the old
token's refresh id was already gone from HA.

Fix: after storing the new token, drop the old session and reconnect with the
NEW token to perform the revoke. The session is then not the one being deleted,
so the ack reads cleanly and the report is accurate.

This matters beyond cosmetics: the false warning fired on every successful
rotation, which would train an operator to ignore it — and a genuine revoke
failure would then be indistinguishable noise. With the fix, a warning means a
real un-revoked token.

Verified end-to-end against live HA on a throwaway token: revoke over the new
session returns success=True and the old token is confirmed gone (where the old
flow got "connection closed"). clippy -D warnings clean; 12 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-21 12:14:55 +02:00

fix(secret-rotator): revoke old HA token over a new-token session #321