catch (error) {
    if (isAuthError(error)) {
        const result = { data: null, error };
        if (!isAuthRetryableFetchError(error)) {
            await this._removeSession();  // 💀 Permanently deletes session from storage
        }
        this.refreshingDeferred?.resolve(result);
        return result;
    }
}

const hasExpired = currentSession.expires_at
    ? currentSession.expires_at * 1000 - Date.now() < EXPIRY_MARGIN_MS  // 90,000ms
    : false;

if (hasExpired) {
    // Token still valid for up to 90s, but SDK considers it "expired"
    const { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
    // If this fails → session PERMANENTLY DELETED
}

import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
import { GoTrueClient } from "@supabase/auth-js";

describe("getSession permanently null after failed refresh", () => {
  let authClient: GoTrueClient;
  let memoryStore: Record<string, string>;

  const createExpiringSession = (secondsUntilExpiry: number) => ({
    access_token: "still-valid-access-token",
    refresh_token: "refresh-token-abc123",
    expires_in: secondsUntilExpiry,
    expires_at: Math.floor(Date.now() / 1000) + secondsUntilExpiry,
    token_type: "bearer",
    user: {
      id: "user-123",
      email: "test@example.com",
      aud: "authenticated",
      role: "authenticated",
      app_metadata: {},
      user_metadata: {},
      created_at: new Date().toISOString(),
    },
  });

  beforeEach(() => {
    vi.useFakeTimers({ shouldAdvanceTime: false });
    memoryStore = {};

    // Mock fetch: returns 400 for refresh (simulates token rotation race)
    const mockFetch = vi.fn().mockImplementation(async (url: string) => {
      if (url.includes("/token?grant_type=refresh_token")) {
        return {
          ok: false,
          status: 400,
          json: async () => ({
            error: "invalid_grant",
            error_description: "Invalid Refresh Token: Already Used",
          }),
          headers: new Headers({ "Content-Type": "application/json" }),
        };
      }
      return { ok: true, status: 200, json: async () => ({}), headers: new Headers() };
    });

    authClient = new GoTrueClient({
      url: "https://fake.supabase.co/auth/v1",
      headers: { apikey: "fake-anon-key" },
      storageKey: "sb-test-auth-token",
      autoRefreshToken: false,
      persistSession: true,
      detectSessionInUrl: false,
      storage: {
        getItem: (key: string) => memoryStore[key] ?? null,
        setItem: (key: string, value: string) => { memoryStore[key] = value; },
        removeItem: (key: string) => { delete memoryStore[key]; },
      },
      fetch: mockFetch,
    });
  });

  afterEach(() => vi.useRealTimers());

  it("BUG: session within 90s margin → refresh 400 → session PERMANENTLY deleted", async () => {
    // Token expires in 60s — within the 90s EXPIRY_MARGIN but STILL VALID
    const session = createExpiringSession(60);
    memoryStore["sb-test-auth-token"] = JSON.stringify(session);

    expect(memoryStore["sb-test-auth-token"]).toBeDefined(); // Session IS in storage

    const result1 = await authClient.getSession();

    // SDK tried to refresh, got 400, called _removeSession()
    expect(result1.data.session).toBeNull();
    expect(memoryStore["sb-test-auth-token"]).toBeUndefined(); // 💀 DELETED from storage

    // All subsequent calls return null forever — no recovery
    const result2 = await authClient.getSession();
    expect(result2.data.session).toBeNull();
    expect(result2.error).toBeNull(); // No error reported — silent failure
  });
});

// Instead of unconditionally deleting:
if (!isAuthRetryableFetchError(error)) {
    await this._removeSession();
}

// Consider: only remove if the token has ACTUALLY expired
if (!isAuthRetryableFetchError(error)) {
    const currentSession = await this._getSessionFromStorage();
    const actuallyExpired = currentSession?.expires_at
        ? currentSession.expires_at * 1000 < Date.now()
        : true;
    if (actuallyExpired) {
        await this._removeSession();
    } else {
        // Token still valid — keep it, log the refresh failure, try again later
        this._debug('_callRefreshToken', 'refresh failed but token still valid, keeping session');
    }
}