refreshable
@forge/monorepo / backend/src / refreshable
Function: refreshable()
refreshable(
credential,expiresAt):RefreshableCredential
Defined in: backend/src/tools/credentials.ts:336
Adds an expiry to a credential without losing its secret protection — AC-6.
This exists because the obvious way to build one is wrong, and wrong invisibly. A host writing a
CredentialRefresher reaches for:
return { ...bearer(accessToken), expiresAt }; // ← the secret is now enumerable
createCredential defines the secret non-enumerably, which is precisely what makes it survive a
JSON.stringify into a log line — and precisely what a spread drops. The result looks identical, works
identically, and serialises the token into the first structured log that touches it.
Found by the AC-6 test failing against this repository's own test helper, which had made exactly that mistake. If the helper made it, a host will.
Parameters
credential
expiresAt
string